T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:40
- Finding
- Password Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 40–43 and line 63 **Vulnerability Type**: Password exposure through process arguments and command history **Risk Level**: Medium ### Vulnerable Code ```bash qjzd-nav auth login \ --profile default \ --url https://nav.qjzd.online \ --password <password> ``` The non-interactive workflow reinforces this unsafe pattern: ```text - In non-interactive mode, `qjzd-nav auth login` requires `--profile`, `--url`, and `--password`. ``` ### Technical Analysis The documented authentication workflow requires the user or an automation system to supply an account password through the `--password` command-line argument. This places the secret in the process argument vector. Depending on the operating system and execution environment, command-line arguments may be exposed through process-inspection utilities, shell history, terminal recordings, CI/CD logs, debugging output, monitoring systems, or Agent execution transcripts. RSA encryption only protects the password after the CLI reads and encrypts it; it does not prevent local disclosure at the point where the command is constructed or executed. ### Attack Path 1. A user, Agent, or automation job follows the documented login workflow. 2. It replaces the placeholder with a real password and invokes `qjzd-nav auth login --password ...`. 3. The command is retained in shell history or automation logs, or its arguments are observed while the process is running. 4. An attacker with access to those local records, logs, or process metadata extracts the password. 5. The attacker reuses the credential to authenticate to the configured QJZD Nav service. ### Impact Assessment Successful exploitation discloses the user's QJZD Nav account password. An attacker could authenticate with the victim's privileges and access or modify resources available to that account. The precise scope depends on the victim account ...[truncated 243 chars]
- Remediation
- ## Remediation Suggestions - Make an interactive, non-echoing password prompt the default authentication mechanism. - For non-interactive use, accept the password through a protected file descriptor, standard input, or direct secret-manager integration instead of a command-line argument. - If environment-variable or temporary-file support is unavoidable, document its exposure risks, enforce restrictive file permissions, and delete temporary secret material immediately after use. - Ensure the CLI redacts passwords from application logs, diagnostics, errors, telemetry, and structured output. - Update `SKILL.md` to remove examples that place passwords directly in process arguments. - Document operational controls for disabling command tracing and preventing CI/CD systems from logging authentication commands. - Consider supporting short-lived tokens or scoped credentials so that disclosure has a smaller impact than exposure of a reusable account password.