T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:36
- Finding
- Credentials Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 36–44 **Vulnerability Type**: Credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash # 1. 获取 tenant_access_token TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d '{"app_id":"YOUR_APP_ID","app_secret":"YOUR_APP_SECRET"}' | jq -r '.tenant_access_token') # 2. 获取群消息历史，提取 mentions curl -s "https://open.feishu.cn/open-apis/im/v1/messages?container_id_type=chat&container_id=CHAT_ID&page_size=50" \ -H "Authorization: Bearer $TOKEN" | \ jq '[.data.items[]? | select(.mentions != null and .mentions != []) | .mentions[]?] | unique_by(.id)' ``` ### Technical Analysis The documentation instructs users to pass the Feishu application secret directly in a `curl` request-body argument. It also expands the tenant access token into an HTTP-header argument. After shell expansion, both values can become part of the `curl` process argument vector. Depending on operating-system process visibility and security configuration, command-line arguments may be observable by other local users, privileged processes, process-monitoring agents, debugging tools, audit systems, or command wrappers. These values may also be copied into diagnostic logs if shell tracing or verbose command logging is enabled. The placeholders are not hardcoded credentials, but users following the example are expected to replace them with real credentials. The vulnerability therefore occurs when the documented command is used as intended. ### Attack Path 1. A user replaces `YOUR_APP_SECRET` and related placeholders with valid Feishu credentials. 2. The user executes the documented shell commands. 3. The shell places the application secret and expanded bearer token in the `curl` process arguments. 4. A local attacker, privileged monitoring component, or command-logging mechanism captures those arguments ...[truncated 1021 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not place application secrets or bearer tokens directly in command-line arguments. - Use a credential-aware Feishu SDK or another client that can receive secrets through protected in-memory configuration. - If `curl` must be used, provide sensitive request data through standard input or a temporary configuration file instead of the argument vector. - Create any temporary credential file with permissions restricted to the current user, such as mode `0600`, and securely remove it immediately after use. - Disable shell tracing before handling credentials and ensure process-monitoring or audit systems redact authorization headers and request bodies. - Store long-lived application secrets in an operating-system secret store or managed secrets service rather than source files, shell history, or project documentation. - Grant the Feishu application only the permissions required for message sending and mention processing. - Rotate the application secret and revoke or invalidate affected tokens if command arguments may already have been logged or observed. ]]>