T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/xianyu-login.js:3
- Finding
- Undocumented Hard-Coded Phone Number Submitted Through an SMS Authentication Flow<![CDATA[ ## Vulnerability Details **File Location**: `scripts/xianyu-login.js:3-64` **Vulnerability Type**: Hard-coded personal data and unauthorized external action **Risk Level**: High ### Vulnerable Code ```javascript const phone = '15982192571'; // ... await page.goto('https://www.goofish.com', { waitUntil: 'networkidle', timeout: 30000 }); // ... const phoneInput = await page.$( 'input[type="tel"], input[placeholder*="手机"], input[placeholder*="号码"]' ); if (phoneInput) { await phoneInput.fill(phone); console.log('✅ 已输入手机号:', phone); await page.waitForTimeout(1000); await page.screenshot({ path: '/tmp/xianyu_step3.png' }); const codeBtn = await page.$('text=获取验证码, text=发送验证码'); if (codeBtn) { await codeBtn.click(); console.log('✅ 已点击获取验证码'); await page.waitForTimeout(2000); await page.screenshot({ path: '/tmp/xianyu_step4.png' }); } } ``` ### Technical Analysis The script embeds a real-looking phone number directly in source code, enters it into the Goofish login form, and activates the control that requests an SMS verification code. This behavior transmits personal data to an external service and generates an authentication event without obtaining runtime confirmation from the affected number's owner. The script is not disclosed in the documented repository file structure or normal two-mode scraping workflow. Triggering SMS authentication is also not necessary for the Skill's declared generic web-scraping functionality. The number is printed to process output, and screenshots of the authentication flow are saved under predictable names in the shared `/tmp` directory. Depending on the page state, those screenshots may contain the phone number, authentication status, account details, or other sensitive interface content. ### Attack Path 1. An operator or Agent invokes `node scripts/xianyu-login.js`. 2. The script opens the Goofish website and selects the login workflow. 3. It automa ...[truncated 845 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the hard-coded phone number from the repository and its history. 2. Remove the undocumented login script unless authenticated scraping is an explicitly declared and reviewed feature. 3. If login automation is required, accept the phone number only through an interactive, consent-based prompt or a protected secret provider. 4. Require explicit confirmation immediately before requesting an SMS code. 5. Never print the complete phone number; mask all but a small number of digits. 6. Disable authentication screenshots by default and redact sensitive form fields before capture. 7. If temporary screenshots are necessary, create a private temporary directory with mode `0700`, generate unpredictable file names, set files to mode `0600`, and securely remove them after use. 8. Add rate limiting and prevent repeated SMS requests. ]]>