T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:169
- Finding
- Plaintext AppSecret Stored in a Project-Root Spreadsheet<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:169-173, 178-180, 199-202`; `assets/generate_excel_template.py:35-40` **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium ### Vulnerable Code `SKILL.md:169-173`: ```text 1. Run assets/generate_excel_template.py from this Skill directory. 2. Copy the generated assets/SMSSDK_iOS_Config_Template.xlsx to the user project root. 3. Name it SMSSDK_iOS_Config.xlsx in the user project root. ``` `SKILL.md:178-180`: ```text - appKey - appSecret - Whether an SMS signature has been requested ``` `assets/generate_excel_template.py:35-40`: ```python rows = [ ["appKey", "MobTech backend AppKey, required", ""], ["appSecret", "MobTech backend AppSecret, required", ""], ["短信签名是否已申请", "上线前必须申请自定义短信签名；默认签名仅用于测试。只填 是 或 否", "否"], ["是否需要语音验证码", "本次是否同时接入语音验证码。只填 是 或 否", "否"], ["是否需要本机号码认证", "本次是否同时接入 getMobileAuthTokenWith 和 verifyMobileWithPhone。只填 是 或 否", "否"], ] ``` ### Technical Analysis The Skill directs the agent to place `SMSSDK_iOS_Config.xlsx` in the target project's root directory and asks the user to enter an AppSecret into that workbook. Although the Skill advises against embedding the secret in source code, it does not require the workbook to be excluded from version control, verify whether it is already tracked, restrict its filesystem permissions, or remove or sanitize it after transferring the configuration. Project-root files are commonly included by broad staging commands such as `git add .`, archived with the project, uploaded to collaboration systems, or copied into backups. Consequently, storing an AppSecret in this location creates a credible accidental disclosure path. ### Attack Path 1. The agent generates and copies `SMSSDK_iOS_Config.xlsx` into the project root. 2. The user enters a valid MobTech AppSecret into the workbook. 3. The workbook remains in the project without a mandatory `.gitignore` rule or cleanup process. 4. A developer sta ...[truncated 900 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Add `SMSSDK_iOS_Config.xlsx` and generated credential workbooks to `.gitignore` before asking the user to populate them. 2. Check whether the workbook is already tracked with a command such as `git ls-files --error-unmatch SMSSDK_iOS_Config.xlsx`. 3. If it is tracked, stop processing and instruct the user to remove it from version control and rotate any exposed credential. 4. Display an explicit warning that the workbook contains secrets and must not be committed, uploaded, emailed, or included in project archives. 5. Prefer an ignored local configuration file, environment variables, a keychain, or a dedicated secret-management system instead of a spreadsheet. 6. If a workbook must be used, apply restrictive filesystem permissions and delete or sanitize it immediately after the configuration has been transferred. 7. Add a final audit step that searches staged and tracked files for `SMSSDK_iOS_Config.xlsx`, `MOBAppSecret`, and the supplied credential value. 8. Avoid reproducing the actual AppSecret in generated documentation, logs, command output, or diagnostic messages. ]]>