T09 · Insecure Skill Coding Practices
Warning
- Location
references/registry.md:29- Finding
Registry credentials may be exposed through command-line arguments
- Content
View full analysis
-p ``` ### Technical Analysis The documentation presents Docker's `-p`/`--password` option as an actionable non-interactive login example. If an Agent substitutes an actual password or personal access token into this command, the secret becomes part of the command line. Command-line secrets may be exposed through: - Shell history files - Process listings and process-monitoring utilities - Terminal session recordings - CI/CD command logs - Debugging or telemetry systems that capture executed commands - Agent execution transcripts Although the same file recommends `--password-stdin`, retaining the insecure example can still cause an Agent or user to select the unsafe alternative. The placeholder is not itself a real secret, but the documented usage pattern becomes vulnerable when populated with operational credentials. ### Attack Path 1. A user asks the Agent to authenticate to a Docker registry non-interactively. 2. The Agent follows the example at line 29 or line 109. 3. The Agent substitutes a real registry password or token into the `-p` argument. 4. The command is recorded in shell history, logs, telemetry, or a process-monitoring system. 5. A local user or log reader retrieves the exposed credential. 6. The attacker authentic ...[truncated 727 chars]- Remediation
View remediation