T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:62
- Finding
- Plaintext Private Keys May Be Exposed Through Command-Line Wallet Import<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 62–69 **Vulnerability Type**: Plaintext secret exposure through command-line arguments **Risk Level**: High ### Vulnerable Code ```bash devtopia id wallet import <privateKeyOrKeystore> ``` ```text Accepts: - PEM-formatted private key: `-----BEGIN PRIVATE KEY-----...-----END PRIVATE KEY-----` - JSON keystore: `{"algorithm":"aes-256-gcm",...}` ``` ### Technical Analysis The documented wallet-import interface permits a PEM-formatted private key to be supplied directly as a command-line argument. Secrets passed this way may be exposed through: - Shell history files - Process listings and process-monitoring tools - Terminal session recording - CI/CD job logs - Command auditing and telemetry - Wrapper scripts that log their arguments The risk applies even if the imported key is subsequently encrypted because the key has already appeared in plaintext at the process invocation boundary. This behavior also conflicts with the statement at `SKILL.md:190` that the private key is “never exported in plaintext.” ### Attack Path 1. A user follows the documented syntax and passes a PEM private key directly to `devtopia id wallet import`. 2. The shell stores the command in history, or a local monitoring/logging system records the process arguments. 3. An attacker with access to the history, logs, process metadata, or recorded terminal session retrieves the plaintext key. 4. The attacker imports the key into another wallet or compatible signing tool. 5. The attacker signs proofs or transactions while impersonating the legitimate agent. ### Impact Assessment Disclosure of the private key grants the attacker the cryptographic authority associated with the wallet. Depending on how the identity is used, this may allow: - Agent identity impersonation - Forging challenge-response proofs - Unauthorized blockchain transaction signing - Unauthorized marketplace actions - Permanent compromise of the wallet-b ...[truncated 152 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not accept literal private keys through command-line arguments. - Accept a path to a protected key file instead, and validate that its permissions prevent access by other users. - Alternatively, read private-key material from masked interactive input or standard input. - Avoid environment variables for long-lived private keys because environments can also leak through diagnostics and process inspection. - Ensure imported key buffers are cleared from memory when no longer required. - Prevent sensitive values from appearing in errors, telemetry, audit logs, or debug output. - Update the documentation to use a safe interface, for example: ```bash devtopia id wallet import --keystore-file ~/.secure/identity-keystore.json ``` - If plaintext PEM import is essential, prompt for it interactively and document the operational risks explicitly. ]]>