T09 · Insecure Skill Coding Practices
Error
- Location
- references/cli-examples.md:8
- Finding
- Plaintext Secret Disclosure Through Terminal Output and Insecure File Persistence## Vulnerability Details **File Location**: `references/cli-examples.md`, lines 8-21 **Vulnerability Type**: Plaintext sensitive-data exposure and insecure secret persistence **Risk Level**: High ### Vulnerable Code ```bash - `op read op://app-prod/db/password` - `op read "op://app-prod/db/one-time password?attribute=otp"` - `op read "op://app-prod/ssh key/private key?ssh-format=openssh"` - `op read --out-file ./key.pem op://app-prod/server/ssh/key.pem` ## Run - `export DB_PASSWORD="op://app-prod/db/password"` - `op run --no-masking -- printenv DB_PASSWORD` - `op run --env-file="./.env" -- printenv DB_PASSWORD` ## Inject - `echo "db_password: {{ op://app-prod/db/password }}" | op inject` - `op inject -i config.yml.tpl -o config.yml` ``` ### Technical Analysis The documented examples resolve sensitive 1Password references and expose the resulting plaintext through standard output or ordinary files: - `op read` prints passwords, one-time passwords, and private keys directly to the terminal. - `op run --no-masking` explicitly disables 1Password's output masking and then prints the resolved database password. - `op read --out-file ./key.pem` writes a private key to the current directory without requiring restrictive permissions or cleanup. - `op inject -o config.yml` creates a persistent configuration file containing resolved secrets. - Piping an injected password to standard output can place it in terminal scrollback, automation output, or Agent transcripts. This behavior conflicts with the guardrails in `SKILL.md`, particularly the instructions not to place secrets in logs or chat and to prefer mechanisms that avoid writing secrets to disk. The required tmux workflow also uses `capture-pane`; if a secret-producing example is executed before pane capture, the plaintext can be copied into tool output or an Agent-visible transcript. ### Attack Path 1. The Agent follows one of the documented read, run, ...[truncated 1311 chars]
- Remediation
- ## Remediation Suggestions 1. Remove examples that print resolved passwords, OTPs, or private keys to standard output. 2. Remove `--no-masking`; retain 1Password's default masking protection. 3. Demonstrate `op run` by passing secret-backed environment variables directly to a trusted application rather than using `printenv`, `echo`, or similar output commands. 4. Do not capture tmux panes after commands that may emit secrets. Separate authentication verification from secret-consuming operations and capture only known non-sensitive output. 5. Avoid persistent output files wherever possible. Prefer passing injected data directly to the intended process through standard input or an ephemeral protected channel. 6. If writing a secret-bearing file is operationally necessary: - Obtain explicit user confirmation. - Use a user-selected safe destination. - Set `umask 077` before creation. - Enforce file mode `0600`. - Avoid shared or predictable temporary paths. - Document secure deletion and perform cleanup immediately after use. 7. Warn users that generated configuration files, private keys, shell output, terminal scrollback, and automation logs may contain plaintext secrets. 8. Add a validation rule prohibiting secret-producing commands from being combined with `capture-pane`, logging, debugging output, or transcript collection.