T09 · Insecure Skill Coding Practices
Warning
- Location
picnic-cli.mjs:45- Finding
Account Credentials Exposed Through Command-Line Arguments
- Content
View full analysis
[countryCode=DE]' }); process.exit(1); } ``` The corresponding documented command is: ```bash node {baseDir}/picnic-cli.mjs login DE ``` ### Technical Analysis The login command obtains the Picnic account password directly from `process.argv`. Command-line arguments are not an appropriate channel for secrets because they may be: - Recorded in shell history. - Visible to other processes or users through operating-system process inspection facilities. - Captured in Agent execution traces, terminal session logs, audit logs, or process monitoring systems. - Retained by wrappers or automation platforms that log invoked commands. Although the password is not explicitly written to a project file, exposing it through the process argument vector creates an avoidable local disclosure risk. ### Attack Path 1. A user follows the documented setup instructions and runs the login command with their email address and password. 2. The shell records the complete command, or the operating system exposes the active process arguments. 3. A local user, monitoring process, execution wrapper, or log reader obtains the password. 4. The exposed credentials are used to attempt access to the victim's Picnic account. 5. If additional authentication is not required or can be separately satisfied, the attacker may access account and grocery-ordering functionality. ### Impact Assessment Successful exploitation exposes the user's Picnic account credentials. The resulting access is limited to privileges available to that Picnic account but may include acce ...[truncated 227 chars]- Remediation
View remediation
[countryCode] ``` The CLI should then securely prompt for the password. - Warn users to remove existing password-bearing commands from shell history and execution logs. - Add automated tests confirming that secrets are never included in command arguments, normal output, or error output. ]]>