T09 · Insecure Skill Coding Practices
Error
- Location
- assets/rpc-handler.ts:69
- Finding
- Service-role credential exposed through child-process arguments<![CDATA[ ## Vulnerability Details **File Location**: `assets/rpc-handler.ts:69-75` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: High ### Vulnerable Code ```typescript async function keychainStore(url: string, serviceRoleKey: string): Promise<void> { await execFileAsync("node", [ "-e", `const k=require(${JSON.stringify(KEYCHAIN_JS)});k.store(${JSON.stringify(url)},${JSON.stringify(serviceRoleKey)});`, ]); } ``` ### Technical Analysis The Supabase service-role key and project URL are serialized directly into the argument passed to `node -e`. Although `execFileAsync` avoids shell interpretation, it does not protect argument confidentiality. The resulting command line can be visible to local process-inspection utilities, endpoint monitoring software, audit systems, crash collectors, or other processes with sufficient access. The service-role key is particularly sensitive because it bypasses Supabase Row Level Security. This subprocess is unnecessary for confidential data transport. If CommonJS interoperability requires a child process, the credentials should be supplied over a protected standard-input pipe rather than placed in `argv`. ### Attack Path 1. A user connects the Skill to Supabase through the dashboard. 2. The gateway calls `keychainStore`. 3. A transient `node -e` process starts with the complete service-role key embedded in its command-line argument. 4. A local process monitor, telemetry agent, or sufficiently privileged local process records or reads that argument. 5. The captured key is used to invoke Supabase APIs with service-role privileges. ### Impact Assessment An attacker who captures this credential may obtain broad access to the associated Supabase project. The service-role credential can bypass RLS and may permit reading or modifying data beyond the Vault functions, depending on the project configuration. The Skill recommends a dedicated project, which reduces collat ...[truncated 67 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never place credentials in command-line arguments. - Pass a JSON payload through the child process's standard input. - Have the child read from file descriptor 0 and immediately clear temporary buffers after parsing. - Alternatively, import the keychain module through a controlled compatibility wrapper without spawning a child process. - Ensure errors and telemetry never include the supplied service-role key. - Document and enforce service-role key rotation after any suspected process-argument exposure. ]]>