T09 · Insecure Skill Coding Practices
Warning
- Location
- assets/generate_excel_template.py:460
- Finding
- Plaintext Collection and Client-Side Storage of Platform Secrets<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:254-275`, `SKILL.md:303-318`, `SKILL.md:339-359`, `SKILL.md:482-487`; `assets/generate_excel_template.py:21-25`, `assets/generate_excel_template.py:34-37`, `assets/generate_excel_template.py:58-61`, `assets/generate_excel_template.py:225-228`, `assets/generate_excel_template.py:300-303`, `assets/generate_excel_template.py:460-463` **Vulnerability Type**: Plaintext sensitive-data storage and client-side secret exposure **Risk Level**: Medium ### Vulnerable Code The workbook generator creates plaintext fields for MobTech and third-party platform secrets: ```python create_sheet( wb, "基础信息", ["字段", "值", "说明"], [ ["mobAppKey", "", "MobTech 后台申请得到的 AppKey"], ["mobAppSecret", "", "MobTech 后台申请得到的 AppSecret"], ["needShareUI", "", "YES / NO，是否需要官方分享面板 UI"], ["needAuth", "", "YES / NO，是否需要第三方登录授权"], ], {"A": 24, "B": 34, "C": 64}, ) ``` Platform worksheets similarly solicit confidential values: ```python { "title": "微信", "category": "国内", "open_url": "http://open.weixin.qq.com", "apply_tips": "链接", "fields": [ ("appId", "", "微信开放平台 appId，以 wx 开头"), ("appSecret", "", "微信开放平台 appSecret"), ("universalLink", "", "官方示例要求配置"), ("useWeChatFull", "", "YES / NO，YES 时使用 WeChatFull"), ], }, ``` The Skill instructs the agent to copy this workbook into the target project's root directory and have the user populate it: ```text 1. Run assets/generate_excel_template.py from the Skill directory. 2. Generate or update assets/ShareSDK_Config_Template.xlsx. 3. Copy assets/ShareSDK_Config_Template.xlsx to the user project's root. 4. Name the copied file ShareSDK_Config.xlsx. ``` The Skill also directs the agent to place the MobTech secret in the application property list: ```text At minimum, validate and write: - MOBAppKey - MOBAppSecret - CFBundleURLTypes - LSApplicationQueriesSchemes ``` ### Technical Anal ...[truncated 3458 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Classify every configuration value** - Document which values are public mobile client identifiers and which are confidential credentials. - Do not request server-capable secrets unless the mobile SDK strictly requires them and the provider explicitly documents them as safe for client distribution. 2. **Keep confidential credentials on a backend** - Store confidential values in a server-side secret manager. - Have the iOS application communicate with a controlled backend for operations requiring those credentials. - Issue narrowly scoped, short-lived tokens to the client where supported. 3. **Protect the generated workbook** - Automatically add `ShareSDK_Config.xlsx` and generated variants to `.gitignore`. - Warn users before creating the file that it may contain confidential data. - Apply restrictive filesystem permissions where the platform supports them. - Never print workbook values in logs, chat responses, generated documentation, command output, or error messages. - Delete the workbook after successful extraction, or replace confidential cells with redacted placeholders after obtaining explicit user consent. - Prefer a temporary file outside the repository over a file in the project root. 4. **Add repository and CI safeguards** - Run secret scanning before commits and during CI. - Reject commits containing the workbook or recognized credential patterns. - Ensure CI artifacts, caches, and diagnostic bundles do not include the workbook. - If a credential has already entered version control, rotate it and purge it from repository history. 5. **Avoid treating `Info.plist` as a secret store** - Place only provider-documented public client configuration in `Info.plist`. - Clearly warn that all application-bundle values are recoverable by end users. - Move confidential operations and credentials to a backend rather than attempting to hide them through obfuscation. 6. ...[truncated 357 chars]