T09 · Insecure Skill Coding Practices
Error
- Location
- references/setup.md:44
- Finding
- Reusable Container Registry Credential Embedded in Documentation## Vulnerability Details **File Location**: `references/setup.md`, lines 44-50 **Vulnerability Type**: Hardcoded plaintext credential and insecure command-line secret handling **Risk Level**: High ### Vulnerable Code ```bash docker login -u 'ccr$deliver-ronly' registry.d-robotics.cc -p 'VLaeatrjF9yGf6I44trT74zKhUpZSVlr' ``` ### Technical Analysis The Skill embeds a reusable registry username and password directly in distributed documentation. Anyone who can access the project can extract and reuse the credential without authorization from the credential owner. The password is also supplied using Docker's `-p` command-line option. Depending on the environment, this can expose it through: - Shell history - Process inspection - Terminal transcripts - CI/CD logs - Agent execution logs - Copied support or troubleshooting records The document describes this as a shared public-delivery credential, but that does not eliminate the security risk. A shared credential cannot provide effective user attribution, individual revocation, or reliable access auditing. Its disclosure can also disrupt legitimate users if abuse causes the vendor to revoke or rate-limit the account. ### Attack Path 1. An attacker obtains the Skill package or reads a transcript containing `references/setup.md`. 2. The attacker extracts the plaintext username and password. 3. The attacker authenticates to `registry.d-robotics.cc` using the shared account. 4. The attacker enumerates or downloads any resources available to that account. 5. Alternatively, the attacker searches shell history, CI logs, process telemetry, or Agent logs on a system where the command was executed. 6. The attacker continues using the credential until it is rotated or revoked. No evidence establishes write access to the registry. The demonstrated scope is therefore limited to the permissions assigned to the exposed shared account, which appears intended for image deliver ...[truncated 619 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the username and password from the repository and all generated documentation. 2. Ask the registry owner to rotate or revoke the exposed credential immediately. 3. Direct users to obtain individual, least-privilege credentials through the vendor's approved process. 4. Avoid supplying passwords as command-line arguments. Use protected standard input instead: ```bash printf '%s' "$REGISTRY_PASSWORD" | docker login registry.d-robotics.cc \ --username "$REGISTRY_USERNAME" \ --password-stdin ``` 5. Store secrets in an approved secret manager or protected environment variable rather than source files. 6. Configure CI systems to mask registry credentials and prevent command echoing. 7. Prefer short-lived access tokens scoped only to image pulls. 8. Review repository history, published packages, transcripts, and logs for copies of the exposed credential. 9. Enable registry audit logging and investigate use of the shared account after the disclosure date.