T09 · Insecure Skill Coding Practices
Error
- Location
hooks/post-exec-log.sh:31- Finding
Raw Shell Commands Are Persisted Without Secret Redaction or Log-Injection Protection
- Content
View full analysis
> "$LOG_FILE" 2>/dev/null || true ``` ### Technical Analysis The PostExec hook records the complete shell command in `memory/hook-audit.log`. Commands commonly contain sensitive values, including: - API tokens passed through command-line arguments - Passwords supplied to command-line clients - Authorization headers - Signed URLs and query parameters - Database connection strings - Private file paths and user identifiers The command is not passed through the output guard or any equivalent redaction routine. The log file is also created without explicitly enforcing restrictive permissions. Its effective permissions therefore depend on the process umask and surrounding directory permissions. The command is inserted into a line-oriented log without removing newline or control characters. If an attacker can influence a command string, embedded newline characters may create forged audit entries or obscure the actual command that was executed. ### Attack Path 1. An attacker causes the Agent to execute a command containing an inline secret, such as a bearer token or password. 2. The command completes and generates a PostExec event. 3. `post-exec-log.sh` extracts the command and appends it to `memory/hook-audit.log`. 4. The secret remains stored in plaintext until the log is manually removed. 5. A local process or user with read access to the workspace retrieves the secret from the log. For log forgery: 1. An attacker-controlled command value contains a newline followed by text formatted like an audit record. 2. The hook app ...[truncated 709 chars]- Remediation
View remediation