T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:145
- Finding
- Raw Environment Secrets May Be Exposed in Generated Reports## Vulnerability Details **File Location**: `SKILL.md`, lines 145–154; report behavior demonstrated at lines 259–268 **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: High ### Vulnerable Code The parsing instructions extract and retain complete plaintext values from every discovered environment file: ```bash # Parse a single .env file (handles comments, blank lines, quoted values) parse_env_file() { local file="$1" local source_label="$2" grep -E "^[A-Za-z_][A-Za-z0-9_]*=" "$file" 2>/dev/null | while IFS= read -r line; do key="${line%%=*}" value="${line#*=}" echo "$key|$value|$source_label" done } ``` The generated-report example explicitly places those values into a full variable map: ```markdown ### Full Variable Map | Variable | .env | .env.local | .env.staging | .env.production | .env.example | Effective (dev) | Status | |----------|------|------------|--------------|-----------------|--------------|-----------------|--------| | DATABASE_URL | ✓ postgres://localhost | ✓ **postgres://dev-db** | ✓ postgres://stg | ✓ postgres://prod | ✓ placeholder | .env.local | ✅ OK | | STRIPE_SECRET_KEY | ✓ sk_test_xxx | — | ✓ sk_test_stg | ✓ sk_live_xxx | ✓ placeholder | .env (base) | 🔴 .env not gitignored! | ``` ### Technical Analysis Reading environment-variable definitions is necessary for the declared inheritance-analysis functionality. Reading, retaining, and reproducing their complete values is not necessary to determine precedence, presence, conflicts, or missing definitions. The Skill extracts everything after the first equals sign and emits it as part of an intermediate record. Its output template then instructs the Agent to include values from `.env`, `.env.local`, staging, and production files in a report. These files commonly contain API tokens, passwords, private keys, authenticated database URLs, session secrets, and production service credentials. ...[truncated 2022 chars]
- Remediation
- ## Remediation Suggestions 1. **Remove plaintext values from reports by default.** Report only variable names, defining files, override order, presence, and status. 2. **Do not place complete values in Agent context.** Perform parsing and comparison locally where possible, returning only sanitized metadata. 3. **Redact all values consistently.** Sensitive-name heuristics alone are insufficient because arbitrary names and URLs may contain credentials. Use output such as `[REDACTED]`, optionally with non-sensitive metadata such as value length or type. 4. **Use ephemeral hashes for conflict detection.** Compare locally generated keyed hashes when determining whether two definitions differ. Do not print hashes, use unsalted reusable hashes, or retain comparison material after the scan. 5. **Minimize file access.** Exclude `.env.local`, `.env.*.local`, and production environment files by default. Require explicit user authorization before accessing them. 6. **Make value display an explicit per-variable opt-in.** Present a clear disclosure warning and never offer bulk plaintext output. 7. **Sanitize URLs and connection strings.** Remove usernames, passwords, tokens, query parameters, and other embedded credentials before displaying them. 8. **Add output-safety requirements to the Skill.** Explicitly prohibit reproduction of secrets in final answers, diagnostics, examples based on user data, tool traces, and generated files. 9. **Recommend credential rotation after accidental disclosure.** If a report has already exposed real values, affected credentials should be revoked or rotated and retained copies of the report should be removed where possible.