T09 · Insecure Skill Coding Practices
- Location
SKILL.md:7- Finding
Hardcoded Privileged TDengine Credentials
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 7
Vulnerability Type: Hardcoded plaintext credentials and excessive database privileges
Risk Level: HighVulnerable Code Snippet:
bash taos -h localhost -u root -p taosdataTechnical Analysis
The documented connection command exposes both the privileged TDengine username (
root) and its plaintext password (taosdata). Anyone able to read the Skill can recover and attempt to reuse these credentials. Supplying the password as a command-line argument can also expose it through shell history, process listings, logs, or command auditing systems.Use of the database root account violates least-privilege principles because the documented operations are read-only market-data queries and do not require unrestricted administrative access.
Attack Path
- An attacker or untrusted Agent reads
SKILL.md. - The attacker extracts the disclosed username and password.
- If the documented credentials remain active, the attacker runs
taos -h localhost -u root -p taosdatafrom an environment able to reach the service. - The attacker authenticates with root-level database privileges.
- The attacker enumerates accessible databases and performs any operations permitted to the TDengine root account, potentially including reading, modifying, or deleting data and changing database configuration or users.
Exploitation depends on the credentials remaining valid and the attacker having network or local access to the TDengine service.
Impact Assessment
Successful exploitation may grant administrative TDengine access rather than only the read access needed by the documented queries. The affected scope can include all databases, tables, users, and administrative operations available to the root account. Potential consequences include confidential market-data disclosure, unauthorized modification, destructive deletion, service disruption, and creati ...[truncated 38 chars]
- An attacker or untrusted Agent reads
- Remediation
View remediation
Remediation Suggestions
- Immediately rotate the exposed password and verify that the documented value is not active in any environment.
- Create a dedicated read-only TDengine account restricted to the exact databases, tables, and query operations required by this Skill.
- Store credentials in an approved secret manager or protected environment variable rather than in project documentation.
- Avoid passing passwords directly on the command line. Use a secure client configuration, secret-file mechanism with restrictive permissions, or interactive password prompt.
- Review shell histories, CI logs, process telemetry, and documentation copies for prior credential exposure.
- Restrict TDengine network access to approved hosts and monitor privileged login attempts.