T09 · Insecure Skill Coding Practices
- Location
index.js:265- Finding
Sensitive credentials and tokens are exposed through configuration command output
- Content
View full analysis
Vulnerability Details
File Location:
index.js:265-281
Vulnerability Type: Sensitive information exposure through command output
Risk Level: HighVulnerable Code
javascript // Config commands program .command('config') .description('Show current configuration') .action(() => { console.log('Current configuration:'); console.log(JSON.stringify(config, null, 2)); }); program .command('config-set') .description('Set configuration value') .requiredOption('-k, --key <key>', 'Configuration key') .requiredOption('-v, --value <value>', 'Configuration value') .action((options) => { configManager.setConfig(options.key, options.value); console.log(`Configuration updated: ${options.key} = ${options.value}`); });The configuration object printed by the
configcommand is populated throughConfigManager.loadConfig(). That method includes sensitive values loaded from both environment variables and the configuration file:javascript const envMappings = { BBS_BOT_BASE_URL: 'baseUrl', BBS_BOT_USERNAME: 'username', BBS_BOT_PASSWORD: 'password', BBS_BOT_EMAIL: 'email', BBS_BOT_DISPLAY_NAME: 'displayName', BBS_BOT_TOKEN: 'token', BBS_BOT_TIMEOUT: 'timeout', BBS_BOT_RETRY_ATTEMPTS: 'retryAttempts', BBS_BOT_RETRY_DELAY: 'retryDelay' };Technical Analysis
The
configcommand serializes the complete configuration object without redacting authentication data. IfBBS_BOT_PASSWORDorBBS_BOT_TOKENis present, the command discloses it in plaintext.The
config-setcommand independently echoes the supplied value. A command such asbbsbot config-set --key token --value ...therefore prints the token even if its storage permissions are otherwise secure.Terminal output is commonly retained in shell scrollback, CI/CD logs, process supervisors, OpenClaw transcripts, remote support captures, and ...[truncated 1216 chars]
- Remediation
View remediation
Remediation Suggestions
-
Redact all known sensitive fields before displaying configuration:
javascript function redactConfig(config) { const redacted = { ...config }; for (const key of ['password', 'token', 'secret', 'apiKey']) { if (redacted[key] !== undefined) { redacted[key] = '[REDACTED]'; } } return redacted; } console.log(JSON.stringify(redactConfig(config), null, 2)); -
Do not echo values supplied to
config-set. Confirm only the key:javascript configManager.setConfig(options.key, options.value); console.log(`Configuration updated: ${options.key}`); -
Maintain a centralized secret-field denylist or schema so future credential fields are also redacted.
-
Prefer an allowlist of non-sensitive fields that may be displayed, such as
baseUrl,timeout, and retry settings. -
Add automated tests asserting that password and token values never appear in standard output or error output.
-
Treat previously captured logs as potentially compromised and rotate any credentials that may already have been printed.
-