T09 · Insecure Skill Coding Practices
Error
- Location
WALLET.md:18- Finding
Generated Wallet Private Keys Are Exposed Through Application Logs
- Content
View full analysis
'0x...' (64 hex characters) // Derive account from private key const account = privateKeyToAccount(privateKey) console.log("Private Key:", privateKey) console.log("Address:", account.address) ``` The complete example repeats the unsafe behavior: ```typescript // Generate new wallet const privateKey = generatePrivateKey() const account = privateKeyToAccount(privateKey) console.log("=== New Wallet Generated ===") console.log("Private Key:", privateKey) console.log("Address:", account.address) ``` ### Technical Analysis A blockchain private key provides complete signing authority over its corresponding wallet. Printing it to standard output exposes it to every system that captures application output, including terminal scrollback, shell-session recordings, CI/CD logs, centralized logging platforms, agent transcripts, support bundles, and monitoring tools. The later security note advising users not to print private keys does not neutralize the issue because the primary wallet-generation examples remain directly copyable and executable. Development logs are also frequently retained or uploaded, so limiting this pattern to development environments would not provide adequate protection. ### Attack Path 1. A user or AI agent copies and runs the documented wallet-generation example. 2. The generated private key is written to standard output. 3. The output is retained in terminal history, an AI-agent transcript, CI output, or centralized logs. 4. An attacker, administrator, compromised logging service, or unauthorized support user obtains the output. 5. The attacker imports the private key into another ...[truncated 712 chars]- Remediation
View remediation