T09 · Insecure Skill Coding Practices
- Location
SKILL.md:225- Finding
Ed25519 Private Signing Key Exposed Through Standard Output
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 225–235
Vulnerability Type: Plaintext secret disclosure through standard output
Risk Level: MediumVulnerable Code
python priv_bytes = private_key.private_bytes( encoding=serialization.Encoding.Raw, format=serialization.PrivateFormat.Raw, encryption_algorithm=serialization.NoEncryption() ) pub_bytes = public_key.public_bytes( encoding=serialization.Encoding.Raw, format=serialization.PublicFormat.Raw ) print(f'PRIVATE_KEY_B64={base64.b64encode(priv_bytes).decode()}') print(f'PUBLIC_KEY_B64={base64.b64encode(pub_bytes).decode()}')Technical Analysis
The guide exports the generated Ed25519 private key using raw, unencrypted serialization and prints the complete key to standard output after Base64 encoding. Base64 provides no confidentiality and can be trivially reversed.
Standard output is frequently retained in shell scrollback, CI/CD job logs, agent transcripts, terminal-recording systems, centralized observability platforms, and support artifacts. Consequently, following the documented command can unintentionally disclose the agent's signing identity beyond the intended security boundary.
The behavior is unrelated to code execution: the pre-scan's “decode then execute” warning is a false positive. Elsewhere, Base64 decoding is used only to reconstruct an Ed25519 key object. The confirmed weakness is the disclosure of the private key through output.
Attack Path
- An operator or automation agent runs the documented key-generation command.
- The command serializes the Ed25519 private key without encryption.
- The full private key is printed as
PRIVATE_KEY_B64. - Terminal output is captured in a transcript, CI log, monitoring platform, or other readable artifact.
- An attacker with access to that artifact decodes the Base64 value.
- The attacker reconstructs the Ed25519 private key and signs forged GreenHelix events under the victim agent's ...[truncated 793 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not print private keys, bearer tokens, webhook secrets, or exchange credentials to standard output.
- Generate and store the private key directly in an approved secret manager, hardware-backed keystore, or permission-restricted file.
- If file storage is necessary, create the file with owner-only permissions such as
0600and avoid intermediate plaintext files. - Prefer encrypted private-key serialization with a strong passphrase when compatible with the deployment model.
- Expose only the public key in logs and registration commands.
- Redact secret values from CI logs, agent transcripts, debugging output, and observability pipelines.
- Rotate any signing key previously generated using the documented command if its output may have been retained or shared.
- Document a key-rotation and incident-response process for suspected signing-key disclosure.