T09 · Insecure Skill Coding Practices
Error
- Location
scripts/smtp_send.py:21- Finding
SMTP Credentials Can Be Exposed Through Command-Line Arguments or an Attacker-Controlled SMTP Server
- Content
View full analysis
Vulnerability Details
File Location:
scripts/smtp_send.py, lines 3, 19-22, 48-50, 74-76, and 97-107
Vulnerability Type: Credential exposure and insufficient endpoint validation
Risk Level: HighVulnerable Code
python # Usage permits passing the password directly on the command line: # python3 scripts/smtp_send.py <zip_path> <recipient> [--subject title] [--sender sender] [--passwd password] DEFAULT_SENDER = os.environ.get( "SMTP_SENDER", sys.argv[2] if len(sys.argv) > 2 else "" ) DEFAULT_PASSWD = os.environ.get("SMTP_PASSWD", "") SMTP_SERVER = os.environ.get("SMTP_SERVER", "smtp.qq.com") SMTP_PORT = int(os.environ.get("SMTP_PORT", "465")) def send_email_with_attachment( zip_path: str, recipient: str, subject: str = None, sender: str = None, password: str = None, server: str = SMTP_SERVER, port: int = SMTP_PORT ) -> bool: subject = subject or f"科技简报-{os.path.basename(zip_path).replace('.zip','')}" sender = sender or DEFAULT_SENDER password = password or DEFAULT_PASSWD # ... smtp = smtplib.SMTP_SSL(server, port) smtp.login(sender, password) smtp.sendmail(sender, recipient, msg.as_string()) smtp.quit() # ... password = None i = 3 while i < len(sys.argv): if sys.argv[i] == "--subject" and i + 1 < len(sys.argv): subject = sys.argv[i + 1] i += 2 elif sys.argv[i] == "--sender" and i + 1 < len(sys.argv): sender = sys.argv[i + 1] i += 2 elif sys.argv[i] == "--passwd" and i + 1 < len(sys.argv): password = sys.argv[i + 1] i += 2 else: i += 1Technical Analysis
The script supports passing the QQ mailbox authorization code through the
--passwdcommand-line option. Command-line arguments may be retained in shell history, process-monitoring logs, job-runner telemetry, or ...[truncated 2658 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the
--passwdoption entirely. Retrieve the authorization code only from a protected secret manager, an appropriately scoped environment secret, or an interactive non-echoing prompt. - Fix the SMTP endpoint to
smtp.qq.comwhen QQ Mail is the only supported provider. - If endpoint configurability is required, enforce an explicit allowlist of approved SMTP hostnames and ports.
- Reject IP-literal destinations, unexpected ports, malformed hostnames, and hosts outside the approved provider set.
- Keep TLS certificate and hostname validation enabled. Consider provider-specific certificate or public-key pinning where operationally feasible.
- Use a dedicated mailbox authorization code with the narrowest available permissions rather than a primary account password.
- Rotate the authorization code immediately if it has previously been passed through
--passwdor exposed in logs. - Redact secrets and sensitive SMTP responses from job logs and monitoring systems.
- Correct
DEFAULT_SENDER: falling back tosys.argv[2]currently treats the recipient argument as the sender whenSMTP_SENDERis absent. Require an explicit, validated sender instead.
- Remove the