T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:117
- Finding
- Plaintext secrets may be exposed through shell command text## Vulnerability Details **File Location**: `SKILL.md:117-119` and `SKILL.md:143` **Vulnerability Type**: Plaintext credential exposure in command text **Risk Level**: Medium ### Vulnerable Code At `SKILL.md:117-119`: ```sh printf '%s' 'sk-proj-abcdef1234567890' | \ hal-vault add openai -t api_key --tags openai,llm,prod -n "OpenAI production key" ``` At `SKILL.md:143`: ```sh printf '%s' 'sk-proj-newvalue9876543210' | hal-vault update openai --value ``` ### Technical Analysis Although `hal-vault` receives the credential through standard input rather than as one of its arguments, the examples first embed the complete plaintext value in the shell command. If an Agent follows this pattern with a user-provided credential, the value can be captured before it reaches the vault. Agent tool transcripts, execution telemetry, shell tracing, process auditing, command-history mechanisms, and orchestration logs may retain the submitted command text. Consequently, this pattern contradicts the Skill's stated requirement that raw secret values must never be printed into logs or other files. The affected operation does not grant additional operating-system privileges. However, it can disclose every credential stored or rotated through this command pattern to parties capable of reading execution records. ### Attack Path 1. A user supplies an API key, password, token, or other secret for storage. 2. The Agent substitutes that plaintext value into the documented `printf` command. 3. The command is submitted to a shell or execution tool. 4. The execution platform records the complete command in a transcript, telemetry stream, audit record, or shell history. 5. A user, service, or attacker with access to those records retrieves the plaintext credential. 6. The exposed credential is used against the service and privileges associated with that credential. ### Impact Assessment Exposure is limited to secrets processed usi ...[truncated 378 chars]
- Remediation
- ## Remediation Suggestions - Do not interpolate a user-provided secret into shell command text, including quoted `printf` commands. - Prefer the CLI's hidden interactive input prompt when the execution environment supports secure terminal input. - When automation is required, use a secret-aware execution interface that supplies protected standard input without serializing the value into the visible command or transcript. - Replace realistic literal values in examples with explicit placeholders and warn implementers not to substitute secrets directly into command strings. - Disable shell tracing around secret operations and ensure execution telemetry redacts protected standard input. - Review and purge existing command transcripts or logs if real credentials may previously have been handled using this pattern.