T09 · Insecure Skill Coding Practices
Error
- Location
skill-search.js:84- Finding
Browser Cookies Are Exported Broadly and Stored in Plaintext
- Content
View full analysis
c.name === 's_loginState'); ``` ```js // 页面加载后保存最新 cookies（remembered → authenticated 后更新） const freshCookies = await ctx.cookies(); fs.writeFileSync(path.join(__dirname, 'cookies.json'), JSON.stringify(freshCookies, null, 2)); ``` The stored cookies are later loaded into new browser contexts: ```js const cookiesFile = path.join(__dirname, 'cookies.json'); if (!fs.existsSync(cookiesFile)) { process.stderr.write('❌ 没有 cookies.json 且无法连接 Chrome\n'); process.exit(1); } ... await ctx.addCookies(JSON.parse(fs.readFileSync(cookiesFile))); ``` ### Technical Analysis `BrowserContext.cookies()` is called without restricting the request to Marriott URLs. Consequently, the code may export every cookie accessible through the selected Chrome browser context rather than only cookies belonging to `marriott.com.cn`. The resulting cookie collection is serialized as plaintext JSON in the project directory. The write does not explicitly set restrictive permissions, encrypt the file, establish a retention period, or remove the file after the operation. The same file is subsequently treated as a reusable authenticated browser state. This creates two related security failures: 1. The Skill collects more authentication material than is necessary for its declared Marriott booking function. 2. High-value session credentials are persisted as an ordinary plaintext file. ### Attack Path ...[truncated 1536 chars]- Remediation
View remediation