T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/garmin-auth.py:45
- Finding
- Garmin Account Password Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/garmin-auth.py`, lines 45-52; documented usage also appears in `README.md`, line 16, and `SKILL.md`, line 27 **Vulnerability Type**: Exposure of credentials through process arguments and shell history **Risk Level**: High ### Vulnerable Code ```python if len(sys.argv) < 3: print("Usage: python3 garmin-auth.py <email> <password>") print("Example: python3 garmin-auth.py moritz.vogt@vogges.de MyPassword123") sys.exit(1) email = sys.argv[1] password = sys.argv[2] success = setup_oauth(email, password) ``` The documentation instructs users to invoke the script similarly: ```bash python3 scripts/garmin-auth.py your-email@gmail.com your-password ``` ### Technical Analysis The script accepts the Garmin account password as a positional command-line argument. Command-line arguments can be exposed through: - Shell history files. - Process inspection utilities such as `ps`. - Process accounting or endpoint-monitoring software. - Terminal session logging. - Wrapper scripts and automation logs. Although the password is not deliberately written to a project file, placing it in `argv` creates multiple plaintext exposure channels before `client.login()` uses it. The example also contains a personal email address and password-like placeholder, which should not appear in a reusable authentication script. ### Attack Path 1. A user follows the documented authentication command and enters the Garmin password directly in the shell. 2. The shell records the complete command in its history, or another local process inspects the script's process arguments while it is running. 3. A local user, support tool, monitoring agent, or later compromise reads the recorded command. 4. The exposed credentials are used to authenticate to the victim's Garmin account. 5. The attacker can access sensitive fitness and health information available throug ...[truncated 597 chars]
- Remediation
- ## Remediation Suggestions - Remove password parameters from the command-line interface. - Prompt interactively using `getpass.getpass()` so the password is neither displayed nor placed in `argv`. - Prefer a provider-supported browser-based OAuth flow that does not require the Skill to receive the account password. - Remove all password-bearing commands from `README.md` and `SKILL.md`. - Remove the personal email address and password-like example from the script. - Warn affected users to delete relevant shell-history entries and rotate any password previously supplied this way. - Avoid logging authentication inputs or exception details that could contain sensitive material.