T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:29
- Finding
- Wallet Private Key Exposed Through Command-Line Arguments and Third-Party Transfer## Vulnerability Details **File Location**: `SKILL.md`, lines 29-43 **Vulnerability Type**: Wallet credential exposure through command-line arguments and external secret custody **Risk Level**: High **Vulnerable Code Snippet**: ```markdown ### Step 1: Login to Smithery ```bash smithery auth login ``` ### Step 2: Add Sally AI MCP connection ```bash smithery mcp add "sally-labs/sally-ai-mcp?privateKey=0xYOUR_PRIVATE_KEY" \ --id sally-ai \ --force ``` Replace `0xYOUR_PRIVATE_KEY` with your dedicated wallet's private key (must include `0x` prefix). **Security Note**: Your private key is stored encrypted in Smithery's cloud, NOT on your local machine. Clawbot communicates with Smithery's API but never accesses your private key. ``` ### Technical Analysis The setup procedure requires users to place a wallet private key directly inside a command-line argument and URL-style connection string. Secrets supplied this way can be exposed through shell history, terminal logs, process inspection, command auditing, diagnostic output, or CLI error reporting. The command also transfers the key to Smithery for cloud storage and transaction signing. Encryption at rest does not eliminate the risks introduced while the key is entered, transmitted, processed, or accessed for signing. The statement that Clawbot does not access the key does not protect it from local command-line exposure or compromise of the third-party custody environment. ### Attack Path 1. A user replaces `0xYOUR_PRIVATE_KEY` with a real wallet private key. 2. The shell records the complete command in command history, or the argument is exposed through process-monitoring or audit facilities. 3. The Smithery CLI receives and transmits the private key to an external cloud service. 4. An attacker with access to local history, telemetry, logs, process information, or the remote account or service obtains the key. 5. The attacker imports the key into anot ...[truncated 479 chars]
- Remediation
- ## Remediation Suggestions - Do not accept private keys through URLs, connection strings, command-line arguments, environment variables, or configuration files. - Prefer local transaction signing with a wallet application, hardware wallet, or operating-system-backed secure key store. - If remote custody is unavoidable, use an interactive secret-entry mechanism that disables terminal echo and prevents shell-history storage. - Use a narrowly scoped delegated or session key instead of a wallet's primary private key. - Enforce transaction-level spending limits, destination restrictions, expiration, and explicit user approval. - Document the key-processing lifecycle, encryption controls, access policies, retention period, recovery process, and incident-response procedure. - Instruct existing users to remove affected commands from shell history and rotate any key previously entered through this mechanism.