T09 · Insecure Skill Coding Practices
Error
- Location
- register.sh:29
- Finding
- Generated Controller Private Key Is Exposed in Standard Output<![CDATA[ ## Vulnerability Details **File Location**: `register.sh:29-35` **Vulnerability Type**: Plaintext disclosure of sensitive wallet credentials **Risk Level**: High ### Vulnerable Code ```bash CONTROLLER=$(echo "$WALLET_OUTPUT" | jq -r '.address') PRIVATE_KEY=$(echo "$WALLET_OUTPUT" | jq -r '.privateKey') echo "✅ Wallet generated:" echo " Address: $CONTROLLER" echo " Private Key: $PRIVATE_KEY" echo "" echo "⚠️ SAVE YOUR PRIVATE KEY — you'll need it to control your identity." ``` ### Technical Analysis When no controller address is supplied, the script generates a new Ethereum wallet and prints its private key directly to standard output. Standard output is not an appropriate secret-storage channel because it may be captured by CI/CD logs, terminal recording software, agent transcripts, remote execution systems, shell session managers, or centralized logging infrastructure. The private key is the sole credential controlling the generated Ethereum address. Although the script does not transmit the key to the Cortex API, disclosing it through output unnecessarily expands the number of systems and users that may obtain it. This behavior exceeds the minimum privilege and data exposure required for registration. Registration only requires the public controller address; ordinary application output does not need to contain the controller's private key. ### Attack Path 1. A user invokes `register.sh` without providing an existing controller address. 2. The script generates a wallet and extracts its private key. 3. The script prints the private key to standard output. 4. A CI logger, agent transcript, terminal recorder, support log, or another user with access to captured output obtains the key. 5. The attacker imports the exposed key into an Ethereum wallet. 6. The attacker can perform any action authorized to the generated controller address, subject to the relevant smart contract's controller permissions. ### Impact Assessment An attacker who ...[truncated 314 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Require users to provide an existing, securely managed controller address by default. - If wallet generation must remain available, store the private key in an encrypted keystore or dedicated secret manager rather than printing it. - Create any local secret file with restrictive permissions, such as mode `0600`, and avoid predictable paths. - Print only the public controller address and the location of the protected keystore. - Display an explicit warning before generating a wallet and require affirmative user consent. - Ensure CI and automated environments cannot invoke secret generation unless a secure output mechanism is configured. - Document backup and recovery procedures without exposing the raw key in logs. ]]>