T09 · Insecure Skill Coding Practices
Error
- Location
- templates/settings.xml:15
- Finding
- Plaintext Storage of Maven Central Credentials and GPG Passphrase<![CDATA[ ## Vulnerability Details **File Location**: `templates/settings.xml:15-22, 27-34`; also documented in `SKILL.md:55-74` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: High ### Vulnerable Code `templates/settings.xml:15-22`: ```xml <servers> <!-- Central Portal Credentials --> <!-- Get these from https://central.sonatype.com/account --> <server> <id>central</id> <username>REPLACE_WITH_USER_TOKEN_NAME</username> <password>REPLACE_WITH_USER_TOKEN_PASS</password> </server> </servers> ``` `templates/settings.xml:27-34`: ```xml <profile> <id>release</id> <activation> <activeByDefault>false</activeByDefault> </activation> <properties> <gpg.executable>gpg</gpg.executable> <gpg.passphrase>REPLACE_WITH_PASSPHRASE</gpg.passphrase> </properties> ``` The same workflow is presented in `SKILL.md:55-74`: ```xml <settings> <servers> <server> <id>central</id> <username>USER_TOKEN_USERNAME</username> <password>USER_TOKEN_PASSWORD</password> </server> </servers> <profiles> <profile> <id>release</id> <activation> <activeByDefault>false</activeByDefault> </activation> <properties> <gpg.executable>gpg</gpg.executable> <gpg.passphrase>YOUR_GPG_PASSPHRASE</gpg.passphrase> </properties> </profile> </profiles> </settings> ``` ### Technical Analysis The supplied template and documentation instruct users to replace placeholders with a real Maven Central Portal token username, token password, and GPG private-key passphrase in Maven's `settings.xml`. Maven settings files are ordinary XML files, so these values remain readable plaintext unless Maven credential encryption or another secret-management mechanism is used. The project does not instruct users to encrypt the server password, inject secrets temporarily from a secure CI secret provider, restrict ...[truncated 2051 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Encrypt Maven server credentials** - Use Maven's supported password-encryption mechanism and store the master password in `~/.m2/settings-security.xml`. - Replace the plaintext server password in `settings.xml` with the encrypted value. - Protect both files with owner-only permissions. 2. **Use secure CI secret injection** - Store publication tokens and signing passphrases in the CI platform's encrypted secret store. - Generate a temporary Maven settings file only for the release job. - Delete the temporary file in an unconditional cleanup step after publication. - Disable command tracing and ensure secrets are masked in build logs. 3. **Avoid persistent GPG passphrases** - Supply the passphrase only at release time through a protected secret mechanism. - Prefer a hardware-backed signing key, isolated signing service, or dedicated ephemeral release environment where practical. - Do not place the signing passphrase in project-level Maven configuration. 4. **Apply restrictive permissions** - Require `chmod 600 ~/.m2/settings.xml ~/.m2/settings-security.xml`. - Ensure the GPG home directory and private-key material are accessible only to the release account. 5. **Prevent accidental disclosure** - Add explicit warnings that real settings files must never be committed, uploaded as build artifacts, or included in unencrypted backups. - Add relevant settings and generated secret files to `.gitignore`. - Use secret scanning in source control and CI. 6. **Limit credential privileges and lifetime** - Use a dedicated publication token with the minimum available scope. - Rotate tokens and signing credentials periodically and immediately after suspected exposure. - Keep `autoPublish` disabled unless automated publication is strictly required and protected by release approvals. ]]>