T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:227- Finding
Registry Password Exposed Through Docker Command-Line Arguments
- Content
View full analysis
| base64 -d → username:password docker login -u -p swr.cn-north-4.myhuaweicloud.com ``` ``` Equivalent insecure commands also appear in: - `references/task-auth-management.md:40-48` - `references/task-auth-management.md:113-120` - `references/task-auth-management.md:147-151` - `references/swr-api-guide.md:419-424` ### Technical Analysis The documentation instructs the agent or user to pass an SWR registry password to `docker login` using the `-p` command-line option. Secrets passed as command-line arguments can be exposed through process inspection, command tracing, shell history, terminal recordings, CI/CD logs, and execution telemetry. The preceding decoding instruction also converts the Base64-encoded authorization value into plaintext `username:password` material. Base64 is an encoding and provides no confidentiality. If the resulting value is inserted into the documented command, the password becomes visible in the process argument list and potentially in retained execution records. This conflicts with the project's separate instruction not to display full credentials in logs or conversations. ### Attack Path 1. An authorized user or agent invokes `hcloud SWR CreateAuthorizationToken` or `hcloud SWR CreateSecret`. 2. The returned Base64 authorization value is decoded into a plaintext username and password. 3. The documented `docker login -u ... -p ...` command is executed. 4. The plaintext password appears in the process arguments, shell history, CI output, tracing output, or command telemetry. 5. A local user, log reader, monitoring integration, or other party with access to those records captures the credential. 6. The captured creden ...[truncated 806 chars]- Remediation
View remediation