T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:202
- Finding
- Social-Media Credentials Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 202-204 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash neckr0ik-socialposter config set twitter.api_key <key> neckr0ik-socialposter config set twitter.api_secret <secret> neckr0ik-socialposter config set linkedin.access_token <token> ``` ### Technical Analysis The documented configuration workflow instructs users to substitute API keys, API secrets, and access tokens directly into command-line arguments. Real credential values may consequently be recorded in shell history and exposed through process inspection, command auditing, terminal logging, diagnostic collection, or backups. The package does not include the referenced `scripts/social.py` implementation. Therefore, the audit could not verify whether the CLI subsequently stores credentials securely, redacts them from logs, or removes sensitive history entries. ### Attack Path 1. A user follows the documented commands and replaces the placeholders with valid social-media credentials. 2. The shell records the complete command in its history, or the operating system exposes the arguments through process-monitoring or audit facilities. 3. A malicious local user, malware process, support bundle, log collector, or party with access to history backups obtains the credential. 4. The attacker submits the recovered credential to the relevant social-media API. 5. The attacker performs actions permitted by the credential's scopes until it expires or is revoked. This exploitation path requires access to process metadata, shell history, collected logs, or their backups. The available project file does not establish remote exploitation by itself. ### Impact Assessment A disclosed credential may allow unauthorized access to connected Twitter/X or LinkedIn resources. Depending on its platform scopes, the attacker ...[truncated 237 chars]
- Remediation
- ## Remediation Suggestions - Replace command-line secret arguments with masked interactive prompts, standard-input handling, or integration with an operating-system credential store. - If file-based configuration is supported, require restrictive permissions and avoid plaintext storage where practical. - Permit environment-based secret injection only with clear warnings about environment exposure and deployment-specific secret-management guidance. - Ensure credentials are redacted from application logs, errors, telemetry, diagnostics, and configuration output. - Document procedures for deleting affected shell-history entries and rotating credentials that may already have been exposed. - Ship the referenced implementation so reviewers can verify credential storage, access controls, logging behavior, and token lifecycle management. - Recommend narrowly scoped, short-lived tokens and provide explicit revocation and rotation instructions.