T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:213
- Finding
- API Key Stored in Plaintext and Exposed Through Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 48, 200, and 213-221 **Vulnerability Type**: Plaintext credential storage and command-line credential exposure **Risk Level**: Medium ### Vulnerable Code ```bash export CUE_API_KEY="sk你的key" ``` ```bash -H "Authorization: Bearer $(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])")" \ ``` ```python KEY = json.load(open(os.path.expanduser("~/.cue/config.json")))["api_key"] EP = "https://mcp.cuecue.cn/api/omni-reader/mcp/" def call(name, args, timeout=70): body = json.dumps({"jsonrpc":"2.0","id":1,"method":"tools/call", "params":{"name":name,"arguments":args}}).encode() p = subprocess.run(["curl","-sS","--max-time",str(timeout),"-X","POST",EP, "-H",f"Authorization: Bearer {KEY}","-H","Content-Type: application/json", "-H","Accept: application/json, text/event-stream","--data-binary",body], capture_output=True, text=True) ``` ### Technical Analysis The documentation recommends using the `CUE_API_KEY` environment variable, but both executable reference implementations instead retrieve the API key from the plaintext file `~/.cue/config.json`. The instructions do not require restrictive permissions for that file, such as mode `0600`, or for its parent directory. The Python implementation then interpolates the secret into a curl command-line argument: ```python "-H", f"Authorization: Bearer {KEY}" ``` Depending on the operating system and process-monitoring configuration, command-line arguments can be inspected through process-listing tools, process metadata, monitoring agents, diagnostic collectors, or audit logs. A local user or compromised process with sufficient visibility may therefore recover the bearer token while curl is running. This issue does not provide a remote attacker with direct access by itself. Exploitation requires local file-read access, process-inspection access, or access to ...[truncated 1162 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use `CUE_API_KEY` as the primary credential source and fail safely when it is absent. 2. If file-based storage must be supported, require: - `~/.cue` directory permissions of `0700`. - `~/.cue/config.json` permissions of `0600`. - Validation that the file is owned by the current user and is not a symbolic link. 3. Replace the curl subprocess with a standard-library HTTPS client so the bearer token is transmitted in an HTTP header without appearing in a child process argument vector. 4. Never include authorization headers or API keys in logs, exception messages, telemetry, shell traces, or diagnostic output. 5. Redact secrets from subprocess failures and HTTP error reports. 6. Document key rotation and immediate revocation procedures for potentially exposed credentials. 7. If subprocess-based curl usage is unavoidable, pass a protected temporary curl configuration through a restricted file descriptor or another mechanism that does not expose the token in process arguments, and securely remove any temporary material afterward. ]]>