T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/verify_phone.py:72
- Finding
- Sensitive Phone Number and OTP Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/verify_phone.py`, lines 72–73 **Vulnerability Type**: Sensitive data exposure through process arguments **Risk Level**: Medium ```python check_p.add_argument("phone", help="Phone number in E.164 format") check_p.add_argument("code", help="Verification code received") ``` ### Technical Analysis The verification workflow requires users to pass both the phone number and one-time verification code as positional command-line arguments. Command-line arguments are not an appropriate secret-input channel because they may be: - Stored in shell history. - Captured by endpoint monitoring, audit, or process telemetry. - Exposed in diagnostic logs or terminal transcripts. - Temporarily visible to other local users through process-inspection facilities, depending on operating-system permissions and configuration. The OTP is short-lived, but disclosure during its validity period may allow an attacker to submit it to the verification service. Associating the OTP with the simultaneously exposed phone number makes the captured data directly actionable. The script sends the API key, phone number, and OTP only to the declared HTTPS Didit endpoint. That network transmission is necessary for the Skill's stated phone-verification functionality and does not itself exceed minimum required privileges. No unrelated network destination or covert exfiltration behavior was identified. ### Attack Path 1. A user follows the documented workflow and runs the script with the phone number and OTP as positional arguments. 2. The shell records the command in history, process telemetry captures it, or a locally authorized observer inspects the process arguments while it is running. 3. The observer extracts both the phone number and active OTP. 4. Before the OTP expires or reaches its attempt limit, the observer submits the captured values to the corresponding verification endpoint. 5. If the verific ...[truncated 820 chars]
- Remediation
- ## Remediation Suggestions - Remove the OTP positional argument and read it interactively using `getpass.getpass()` so it is not echoed or placed in shell history. - Support protected standard input for automation, with clear guidance to use a restricted pipe or secret-management facility rather than a command-line argument. - Consider collecting the phone number interactively as well where privacy requirements treat it as sensitive personal data. - Update all usage examples in `SKILL.md` and the script docstring so they do not show OTPs directly on the command line. - Document that users should clear any existing shell-history entries, terminal recordings, or automation logs containing real OTPs. - Avoid logging request payloads and redact phone numbers and verification codes from exceptions, diagnostics, and monitoring output.