T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/collector.js:13
- Finding
- Hardcoded Audtools Account Credentials Exposed in Source Code and Documentation## Vulnerability Details **File Location**: `scripts/collector.js:13-24` **Additional Locations**: `SKILL.md:14`, `SKILL.md:69-70`, `README.md:79-80` **Vulnerability Type**: Hardcoded credentials and plaintext sensitive data **Risk Level**: High ### Vulnerable Code `scripts/collector.js:13-24`: ```javascript // 配置参数 const CONFIG = { baseUrl: 'https://www.audtools.com', loginUrl: 'https://www.audtools.com/login', collecUrl: 'https://www.audtools.com/users/shopns#/users/shopns/collecs?spm=m-1-2-3', username: '15715090600', password: 'zzw12345', default_items: 9999, default_interval: 2000, // 毫秒 default_close_delay: 3000, // 毫秒 exportWaitTimeout: 30000, // 导出等待超时（毫秒） }; ``` The same credentials are also disclosed in `SKILL.md`: ```markdown 1. Audtools账号（手机号：15715090600，密码：zzw12345） ``` ```markdown | `username` | `15715090600` | 登录手机号 | | `password` | `zzw12345` | 登录密码 | ``` They are repeated in `README.md`: ```markdown | `username` | `15715090600` | Audtools登录手机号 | | `password` | `zzw12345` | Audtools登录密码 | ``` ### Technical Analysis The project embeds an Audtools phone number and password directly in the executable `CONFIG` object. The `ensureLoggedIn()` function subsequently supplies these values to the Audtools login form, demonstrating that they are operational authentication data rather than inert examples. Hardcoded secrets cannot be protected through application access controls because every person or system able to read the package can recover them. Repeating the credentials in user-facing documentation further increases their exposure through source repositories, package archives, documentation indexing, backups, logs, and forks. Removing the credentials in a later commit would not reliably revoke the disclosure because they may remain available in repository history, caches, prior releases, and downloaded copies. The exposed password must therefore be ...[truncated 1710 chars]
- Remediation
- ## Remediation Suggestions 1. **Rotate the credentials immediately** - Change the exposed Audtools password. - Invalidate active sessions and API tokens, if the service supports doing so. - Review account activity, collection jobs, and exports for unauthorized access. - Change credentials on any other service where the same password was reused. 2. **Remove all plaintext copies** - Delete the phone number and password from `scripts/collector.js`, `SKILL.md`, and `README.md`. - Replace documentation values with clearly nonfunctional placeholders. - Remove the secret from repository history using an appropriate history-rewriting procedure where feasible. - Treat all previously distributed releases and archives as permanently containing the old secret. 3. **Load secrets at runtime** - Read credentials from environment variables or an approved secret manager. - Do not provide functional fallback credentials in source code. - Fail safely with a clear error when required secrets are absent. Example: ```javascript const CONFIG = { baseUrl: 'https://www.audtools.com', loginUrl: 'https://www.audtools.com/login', collecUrl: 'https://www.audtools.com/users/shopns#/users/shopns/collecs?spm=m-1-2-3', username: process.env.AUDTOOLS_USERNAME, password: process.env.AUDTOOLS_PASSWORD, default_items: 9999, default_interval: 2000, default_close_delay: 3000, exportWaitTimeout: 30000, }; if (!CONFIG.username || !CONFIG.password) { throw new Error( 'AUDTOOLS_USERNAME and AUDTOOLS_PASSWORD must be provided securely at runtime' ); } ``` 4. **Protect secret-bearing configuration** - If a local `.env` file is supported, add it to `.gitignore` and provide only a `.env.example` containing placeholders. - Restrict secret access to the minimum required users and runtime identity. - Avoid printi ...[truncated 401 chars]