T09 · Insecure Skill Coding Practices
Error
- Location
references/wsl-commands.md:11- Finding
Hard-Coded Root and Service Credentials Exposed Through Command Lines
- Content
View full analysis
' | su -c 'bash /tmp/install_.sh' - root" & ``` ```markdown | Root password | `123456` | ``` `references/wsl-commands.md`: ```bash # Method 2: Execute as root (bypass the sudo password) wsl.exe -e bash -c "echo '123456' | su -c 'command' - root" # Method 3: SSH root connection (fallback) sshpass -p "123456" ssh root@ "command" ``` ```bash mysql -u root -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY '123456'; FLUSH PRIVILEGES;" redis-cli -a 123456 PING ``` ### Technical Analysis The Skill documents and repeatedly reuses the fixed value `123456` as the WSL root password and as the default MySQL and Redis password. This makes privileged credentials predictable to anyone who can inspect the Skill, its generated commands, documentation, or audit logs. The credentials are also passed through command-line arguments or generated shell command text. Depending on the host and WSL configuration, these values may be exposed through process listings, shell history, terminal capture, Agent transcripts, or operational logs. Reusing one weak password across the operating system and multiple services further increases the blast radius of a single credential disclosure. Using `echo PASSWORD | su` also bypasses the interactive safeguards normally associated with privileged elevation and encourages unattended root execution with a globally known secret. ### Attack Path 1. An attacker reads the Skill package or otherwise learns its documented default password, `123456`. 2. The Skill is used without replacing the default credentials. 3. The attacker identifies a reachable access path, such as an ...[truncated 1150 chars]- Remediation
View remediation