T09 · Insecure Skill Coding Practices
- Location
SKILL.md:44- Finding
Unredacted Command Output and Unsafe Terminal Control-Sequence Rendering
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 44–46; reinforced by lines 5 and 341
Vulnerability Type: Sensitive information disclosure and unsafe rendering of terminal output
Risk Level: MediumVulnerable Instructions
The following is an English translation of the relevant instructions at lines 44–46:
text - Display stdout and stderr in full. - Preserve the original formatting, including color codes when present. - Do not truncate important information.Line 5 additionally requires users to see every command and its complete output, while line 341 requires verification that the complete command was displayed.
Technical Analysis
The skill directs the agent to reproduce complete command lines and raw standard output and error streams without requiring secret redaction or control-character sanitization.
Command arguments and output can contain sensitive values such as API tokens, passwords, authorization headers, cookies, private keys, environment variables, session identifiers, internal paths, and confidential log records. Displaying these values in an agent response can cause them to be retained in conversation history, application logs, telemetry, or downstream integrations.
Preserving original color codes also permits ANSI and other terminal control sequences originating from attacker-controlled filenames, log messages, process output, or remote data. If a client interprets those sequences instead of escaping them, they may alter colors, overwrite displayed text, hide warnings, create misleading links, or otherwise manipulate the presentation of the output.
The long-output handling described elsewhere in the file limits output volume but does not establish secret filtering, data classification, or safe control-character encoding.
Attack Path
- An attacker causes a command, service log, filename, or process to emit a secret or attacker-controlled terminal escape sequence. ...[truncated 1529 chars]
- Remediation
View remediation
Remediation Suggestions
- Add an explicit rule that security and privacy requirements override complete-output presentation.
- Redact passwords, API keys, access tokens, authorization headers, cookies, private keys, connection strings, and sensitive environment variables from commands and output.
- Use both key-name detection and secret-value pattern detection, while allowing users to define additional sensitive fields.
- Replace detected secrets with stable placeholders such as
[REDACTED_TOKEN]so output remains understandable without exposing values. - Strip or visibly escape ANSI escape sequences, bidirectional text controls, carriage returns, and other non-printing control characters by default.
- Display output in bounded sections and require explicit confirmation before revealing additional potentially sensitive content.
- Avoid printing command arguments when they contain credentials. Prefer secure input mechanisms such as standard input, protected files, or environment references.
- Add a warning before displaying logs or configuration files that may contain confidential information.
- Preserve an unmodified output copy only when strictly necessary, in access-controlled storage, and never place it directly into chat history by default.
- Add tests covering secrets in command arguments, environment dumps, authorization headers, private keys, malicious filenames, and ANSI/control-sequence injection.