T09 · Insecure Skill Coding Practices
- Location
SKILL.md:147- Finding
Authentication Secrets Exposed by Troubleshooting Commands
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 147–153
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: MediumVulnerable Code
bash # macOS / Linux: echo "XFYUN_APP_ID: $XFYUN_APP_ID | XFYUN_API_KEY: $XFYUN_API_KEY | XFYUN_API_SECRET: $XFYUN_API_SECRET" # Windows cmd: echo XFYUN_APP_ID: %XFYUN_APP_ID% ^|^| XFYUN_API_KEY: %XFYUN_API_KEY% ^|^| XFYUN_API_SECRET: %XFYUN_API_SECRET%Technical Analysis
The troubleshooting instructions tell users to print the complete values of
XFYUN_API_KEYandXFYUN_API_SECRETto the terminal. This unnecessarily converts credentials stored in environment variables into plaintext output.Terminal output can be exposed through CI logs, shell-session recording, screen sharing, screenshots, copied support transcripts, or other process-output collection. Verifying whether an environment variable is configured requires only a presence check; displaying its full value exceeds the minimum disclosure needed for troubleshooting.
The runtime implementation itself reads only the documented credentials and uses the API secret locally to create an HMAC-SHA256 signature. No direct runtime transmission of the unencoded API secret was identified.
Attack Path
- A user encounters an authentication failure and follows the documented troubleshooting procedure.
- The user runs the provided command, causing the full application ID, API key, and API secret to appear in terminal output.
- That output is retained in a CI log, terminal recording, screenshot, screen-sharing session, or support transcript.
- An attacker or unauthorized observer obtains access to the retained output.
- The attacker extracts the credentials and uses them to generate valid authentication signatures for iFlytek API requests.
- The attacker can consume the victim's OCR quota or paid service allowance and make requests under the victim's application identity until the credentials are revoked.
Impact A
...[truncated 850 chars]
- Remediation
View remediation
Remediation Suggestions
Replace commands that print credential values with presence-only checks. For example:
bash for variable in XFYUN_APP_ID XFYUN_API_KEY XFYUN_API_SECRET; do if [ -n "$(printenv "$variable")" ]; then printf '%s is set\n' "$variable" else printf '%s is missing\n' "$variable" fi doneFor Windows PowerShell, use:
powershell 'XFYUN_APP_ID', 'XFYUN_API_KEY', 'XFYUN_API_SECRET' | ForEach-Object { if ([string]::IsNullOrEmpty([Environment]::GetEnvironmentVariable($_))) { "$_ is missing" } else { "$_ is set" } }Apply the following additional controls:
- Remove all documentation that asks users to print, screenshot, or share complete secrets.
- Instruct users to redact credentials and signed authorization query parameters before sharing diagnostic output.
- Recommend immediate credential rotation if the existing troubleshooting commands were run in recorded or shared environments.
- Prefer a dedicated secret manager or protected CI secret store over plaintext shell startup files.
- Add a safe diagnostic option to the script that reports only whether each required variable is present.
- Document that invoice images may contain sensitive personal and financial information and are transmitted to the third-party iFlytek service.