T09 · Insecure Skill Coding Practices
Warning
- Location
src/index.ts:39- Finding
GLM API Key Exposed Through Verbose Configuration Logging
- Content
View full analysis
0 && !config.dryRun) { throw new ClawCompanyError( '配置验证失败', 'CONFIG_ERROR', { errors } ) } // 2. 初始化日志 logger = new Logger('ClawCompany', config.verbose ? LogLevel.DEBUG : LogLevel.INFO) logger.info('🦞 开始工作...') logger.debug('配置:', config) ``` The sensitive value enters the logged object through the following configuration code: ```ts if (process.env.GLM_API_KEY) { config.glmApiKey = process.env.GLM_API_KEY } ``` ### Technical Analysis `loadConfig()` copies `GLM_API_KEY` from the process environment into the `glmApiKey` property of the configuration object. When verbose mode is enabled, `logger.debug()` passes the complete object to `console.log()` without redaction. Consequently, the API key is emitted in plaintext to standard output. Standard output is frequently retained by CI systems, terminal session recorders, container logging drivers, process supervisors, support bundles, and centralized log aggregation platforms. Verbose diagnostics do not require disclosure of authentication credentials. Logging the complete configuration therefore exceeds the minimum information needed for the declared debugging functionality. The same vulnerable behavior is present in the generated runtime artifact at `dist/index.js:28`. ### Attack Path 1. A user configures a valid `GLM_API_KEY` in the process environment. 2. The user runs the TypeScript/compiled implementation with verbose logging enabled, such as through the `--verbose` option. 3. `loadConfig()` copies the key into `config.glmApiKey`. 4. `logger.debug('配置:', config)` serializes or displays the com ...[truncated 936 chars]- Remediation
View remediation