T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sentiment.py:230- Finding
Plaintext Secret Storage, Retrieval, and Process-Argument Exposure
- Content
View full analysis
dict: if CONFIG_PATH.exists(): try: return json.loads(CONFIG_PATH.read_text(encoding="utf-8")) except Exception: pass return {"tier": "FREE", "glm_api_key": "", "feishu_webhook": "", "smtp_config": {}} def save_config(cfg: dict): CONFIG_PATH.write_text( json.dumps(cfg, ensure_ascii=False, indent=2), encoding="utf-8" ) ``` The GLM API key is also included directly in a subprocess argument: ```python result = subprocess.run( ["curl", "-s", "-X", "POST", GLM_API_URL, "-H", f"Authorization: Bearer {api_key}", "-H", "Content-Type: application/json", "-d", json.dumps(payload, ensure_ascii=False)], capture_output=True, text=True, timeout=30 ) ``` The CLI permits unrestricted retrieval and output of configured values: ```python elif cmd == "config-get": key = sys.argv[2] if len(sys.argv) > 2 else "" val = get_config(key) print(json.dumps({"ok": True, "key": key, "value": val}, ensure_ascii=False)) elif cmd == "config-set": key = sys.argv[2] if len(sys.argv) > 2 else "" value = sys.argv[3] if len(sys.argv) > 3 else "" try: value = json.loads(value) except Exception: pass set_config(key, value) print(json.dumps({"ok": True, "key": key, "value": value}, ensure_ascii=False)) ``` Equivalent `curl` argument exposure also occurs in the batch-analysis and report-summary request paths at lines 885-890 and 1291-1296. ### Technical Analysis The configuration file can contain a GLM API key, a Feishu webhook URL containing a secret token, and SMTP credentials. These values are serialized directly to `~/.sentiment-compass/config.json`. The code does not ex ...[truncated 2124 chars]- Remediation
View remediation