T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/common.ts:279- Finding
Debug Logging Discloses Access Key Identifiers and User Prompts
- Content
View full analysis
= { 'Action': action, 'Version': version, }; query['X-Date'] = datetime; query['X-NotSignBody'] = '1'; query['X-Credential'] = credential; query['X-Algorithm'] = 'HMAC-SHA256'; query['X-SignedHeaders'] = ''; query['X-Expires'] = expires.toString(); ``` The image-generation request logs the beginning of that signed URL and the complete request body: ```typescript if (process.env.DEBUG) { console.error('Debug - Request URL:', url.slice(0, 200) + '...'); console.error('Debug - Request Body:', payload); } ``` The video-generation request contains the same logging behavior: ```typescript if (process.env.DEBUG) { console.error('Debug - Request URL:', url.slice(0, 200) + '...'); console.error('Debug - Request Body:', payload); } ``` ### Technical Analysis The `X-Credential` query parameter contains the Volcengine Access Key identifier. Because query parameters are sorted when the signed URL is constructed, the first 200 characters can include this credential identifier. Truncating a URL is not a reliable redaction mechanism. The complete request body is also written to standard error. This body includes the user-provided generation prompt and task configuration. Prompts may contain confidential project information, unreleased content, personal data, or other sensitive material. Debug logging is activated either by the command-line `--debug` option or by an inherited `DEBUG` environment variable. Consequently, exposure can occur in local terminal history, CI/CD logs, ...[truncated 1498 chars]- Remediation
View remediation