T09 · Insecure Skill Coding Practices
- Location
scripts/collector.js:13- Finding
Hardcoded Audtools Account Credentials Exposed in Source Code and Documentation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/collector.js:13-24
Additional Locations:SKILL.md:14,SKILL.md:69-70,README.md:79-80
Vulnerability Type: Hardcoded credentials and plaintext sensitive data
Risk Level: HighVulnerable Code
scripts/collector.js:13-24:javascript // 配置参数 const CONFIG = { baseUrl: 'https://www.audtools.com', loginUrl: 'https://www.audtools.com/login', collecUrl: 'https://www.audtools.com/users/shopns#/users/shopns/collecs?spm=m-1-2-3', username: '15715090600', password: 'zzw12345', default_items: 9999, default_interval: 2000, // 毫秒 default_close_delay: 3000, // 毫秒 exportWaitTimeout: 30000, // 导出等待超时（毫秒） };The same credentials are also disclosed in
SKILL.md:markdown 1. Audtools账号（手机号：15715090600，密码：zzw12345）markdown | `username` | `15715090600` | 登录手机号 | | `password` | `zzw12345` | 登录密码 |They are repeated in
README.md:markdown | `username` | `15715090600` | Audtools登录手机号 | | `password` | `zzw12345` | Audtools登录密码 |Technical Analysis
The project embeds an Audtools phone number and password directly in the executable
CONFIGobject. TheensureLoggedIn()function subsequently supplies these values to the Audtools login form, demonstrating that they are operational authentication data rather than inert examples.Hardcoded secrets cannot be protected through application access controls because every person or system able to read the package can recover them. Repeating the credentials in user-facing documentation further increases their exposure through source repositories, package archives, documentation indexing, backups, logs, and forks.
Removing the credentials in a later commit would not reliably revoke the disclosure because they may remain available in repository history, caches, prior releases, and downloaded copies. The exposed password must therefore be ...[truncated 1710 chars]
- Remediation
View remediation
Remediation Suggestions
-
Rotate the credentials immediately
- Change the exposed Audtools password.
- Invalidate active sessions and API tokens, if the service supports doing so.
- Review account activity, collection jobs, and exports for unauthorized access.
- Change credentials on any other service where the same password was reused.
-
Remove all plaintext copies
- Delete the phone number and password from
scripts/collector.js,SKILL.md, andREADME.md. - Replace documentation values with clearly nonfunctional placeholders.
- Remove the secret from repository history using an appropriate history-rewriting procedure where feasible.
- Treat all previously distributed releases and archives as permanently containing the old secret.
- Delete the phone number and password from
-
Load secrets at runtime
- Read credentials from environment variables or an approved secret manager.
- Do not provide functional fallback credentials in source code.
- Fail safely with a clear error when required secrets are absent.
Example:
javascript const CONFIG = { baseUrl: 'https://www.audtools.com', loginUrl: 'https://www.audtools.com/login', collecUrl: 'https://www.audtools.com/users/shopns#/users/shopns/collecs?spm=m-1-2-3', username: process.env.AUDTOOLS_USERNAME, password: process.env.AUDTOOLS_PASSWORD, default_items: 9999, default_interval: 2000, default_close_delay: 3000, exportWaitTimeout: 30000, }; if (!CONFIG.username || !CONFIG.password) { throw new Error( 'AUDTOOLS_USERNAME and AUDTOOLS_PASSWORD must be provided securely at runtime' ); } -
Protect secret-bearing configuration
- If a local
.envfile is supported, add it to.gitignoreand provide only a.env.examplecontaining placeholders. - Restrict secret access to the minimum required users and runtime identity.
- Avoid printi ...[truncated 401 chars]
- If a local
-