T09 · Insecure Skill Coding Practices
Error
- Location
scripts/acceptance_rate_analysis.py:104- Finding
Browser access token is automatically persisted in plaintext and can be sent to an environment-controlled endpoint
- Content
View full analysis
None: import winreg with winreg.OpenKey(winreg.HKEY_CURRENT_USER, "Environment", 0, winreg.KEY_SET_VALUE) as registry_key: winreg.SetValueEx(registry_key, "BIGDATA_ACCESS_TOKEN", 0, winreg.REG_SZ, token) _broadcast_windows_environment_change() ``` ```python def _persist_access_token_unix(token: str) -> None: profile_path = _unix_profile_path() profile_path.parent.mkdir(parents=True, exist_ok=True) if profile_path.exists(): existing_text = profile_path.read_text(encoding="utf-8") lines = existing_text.splitlines() else: existing_text = "" lines = [] export_line = f"export BIGDATA_ACCESS_TOKEN={shlex.quote(token)}" updated_lines: list[str] = [] replaced = False for line in lines: stripped = line.strip() if stripped.startswith("export BIGDATA_ACCESS_TOKEN="): updated_lines.append(export_line) replaced = True else: updated_lines.append(line) if not replaced: if updated_lines and updated_lines[-1].strip(): updated_lines.append("") updated_lines.append(export_line) new_text = "\n".join(updated_lines) if new_text and not new_text.endswith("\n"): new_text += "\n" if new_text != existing_text: profile_path.write_text(new_text, encoding="utf-8") ``` ```python def persist_access_token(token: str) -> str: normalized_token = str(token).strip() if not normalized_token: return "" _set_process_access_token(normalized_token) try: persist_access_token_for_future_sessions(normalized_token) ...[truncated 4084 chars]- Remediation
View remediation