T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:147
- Finding
- Authentication Secrets Exposed by Troubleshooting Commands## Vulnerability Details **File Location**: `SKILL.md`, lines 147–153 **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Medium ### Vulnerable Code ```bash # macOS / Linux: echo "XFYUN_APP_ID: $XFYUN_APP_ID | XFYUN_API_KEY: $XFYUN_API_KEY | XFYUN_API_SECRET: $XFYUN_API_SECRET" # Windows cmd: echo XFYUN_APP_ID: %XFYUN_APP_ID% ^|^| XFYUN_API_KEY: %XFYUN_API_KEY% ^|^| XFYUN_API_SECRET: %XFYUN_API_SECRET% ``` ### Technical Analysis The troubleshooting instructions tell users to print the complete values of `XFYUN_API_KEY` and `XFYUN_API_SECRET` to the terminal. This unnecessarily converts credentials stored in environment variables into plaintext output. Terminal output can be exposed through CI logs, shell-session recording, screen sharing, screenshots, copied support transcripts, or other process-output collection. Verifying whether an environment variable is configured requires only a presence check; displaying its full value exceeds the minimum disclosure needed for troubleshooting. The runtime implementation itself reads only the documented credentials and uses the API secret locally to create an HMAC-SHA256 signature. No direct runtime transmission of the unencoded API secret was identified. ### Attack Path 1. A user encounters an authentication failure and follows the documented troubleshooting procedure. 2. The user runs the provided command, causing the full application ID, API key, and API secret to appear in terminal output. 3. That output is retained in a CI log, terminal recording, screenshot, screen-sharing session, or support transcript. 4. An attacker or unauthorized observer obtains access to the retained output. 5. The attacker extracts the credentials and uses them to generate valid authentication signatures for iFlytek API requests. 6. The attacker can consume the victim's OCR quota or paid service allowance and make requests under the victim's application identity until the credentials are revoked. ### Impact A ...[truncated 850 chars]
- Remediation
- ## Remediation Suggestions Replace commands that print credential values with presence-only checks. For example: ```bash for variable in XFYUN_APP_ID XFYUN_API_KEY XFYUN_API_SECRET; do if [ -n "$(printenv "$variable")" ]; then printf '%s is set\n' "$variable" else printf '%s is missing\n' "$variable" fi done ``` For Windows PowerShell, use: ```powershell 'XFYUN_APP_ID', 'XFYUN_API_KEY', 'XFYUN_API_SECRET' | ForEach-Object { if ([string]::IsNullOrEmpty([Environment]::GetEnvironmentVariable($_))) { "$_ is missing" } else { "$_ is set" } } ``` Apply the following additional controls: 1. Remove all documentation that asks users to print, screenshot, or share complete secrets. 2. Instruct users to redact credentials and signed authorization query parameters before sharing diagnostic output. 3. Recommend immediate credential rotation if the existing troubleshooting commands were run in recorded or shared environments. 4. Prefer a dedicated secret manager or protected CI secret store over plaintext shell startup files. 5. Add a safe diagnostic option to the script that reports only whether each required variable is present. 6. Document that invoice images may contain sensitive personal and financial information and are transmitted to the third-party iFlytek service.