T09 · Insecure Skill Coding Practices
- Location
references/cli-examples.md:8- Finding
Plaintext Secret Disclosure Through Terminal Output and Insecure File Persistence
- Content
View full analysis
Vulnerability Details
File Location:
references/cli-examples.md, lines 8-21
Vulnerability Type: Plaintext sensitive-data exposure and insecure secret persistence
Risk Level: HighVulnerable Code
bash - `op read op://app-prod/db/password` - `op read "op://app-prod/db/one-time password?attribute=otp"` - `op read "op://app-prod/ssh key/private key?ssh-format=openssh"` - `op read --out-file ./key.pem op://app-prod/server/ssh/key.pem` ## Run - `export DB_PASSWORD="op://app-prod/db/password"` - `op run --no-masking -- printenv DB_PASSWORD` - `op run --env-file="./.env" -- printenv DB_PASSWORD` ## Inject - `echo "db_password: {{ op://app-prod/db/password }}" | op inject` - `op inject -i config.yml.tpl -o config.yml`Technical Analysis
The documented examples resolve sensitive 1Password references and expose the resulting plaintext through standard output or ordinary files:
op readprints passwords, one-time passwords, and private keys directly to the terminal.op run --no-maskingexplicitly disables 1Password's output masking and then prints the resolved database password.op read --out-file ./key.pemwrites a private key to the current directory without requiring restrictive permissions or cleanup.op inject -o config.ymlcreates a persistent configuration file containing resolved secrets.- Piping an injected password to standard output can place it in terminal scrollback, automation output, or Agent transcripts.
This behavior conflicts with the guardrails in
SKILL.md, particularly the instructions not to place secrets in logs or chat and to prefer mechanisms that avoid writing secrets to disk. The required tmux workflow also usescapture-pane; if a secret-producing example is executed before pane capture, the plaintext can be copied into tool output or an Agent-visible transcript.Attack Path
- The Agent follows one of the documented read, run, ...[truncated 1311 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove examples that print resolved passwords, OTPs, or private keys to standard output.
- Remove
--no-masking; retain 1Password's default masking protection. - Demonstrate
op runby passing secret-backed environment variables directly to a trusted application rather than usingprintenv,echo, or similar output commands. - Do not capture tmux panes after commands that may emit secrets. Separate authentication verification from secret-consuming operations and capture only known non-sensitive output.
- Avoid persistent output files wherever possible. Prefer passing injected data directly to the intended process through standard input or an ephemeral protected channel.
- If writing a secret-bearing file is operationally necessary:
- Obtain explicit user confirmation.
- Use a user-selected safe destination.
- Set
umask 077before creation. - Enforce file mode
0600. - Avoid shared or predictable temporary paths.
- Document secure deletion and perform cleanup immediately after use.
- Warn users that generated configuration files, private keys, shell output, terminal scrollback, and automation logs may contain plaintext secrets.
- Add a validation rule prohibiting secret-producing commands from being combined with
capture-pane, logging, debugging output, or transcript collection.