T09 · Insecure Skill Coding Practices
- Location
scripts/openAPI_call.py:8- Finding
Database Credentials Exposed Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:164-184;scripts/openAPI_call.py:8-13
Vulnerability Type: Plaintext secrets in process arguments
Risk Level: HighVulnerable Code
SKILL.md:164-184:bash .venv/bin/python ./scripts/openAPI_call.py '{ "VpcId": "<VpcId>", "VSwitchId": "<VSwitchId>", "BackupVSwitchId": "<BackupVSwitchId>", "SecurityGroupId": "<SecurityGroupId>", "ZoneId": "<ZoneId>", "DataRegion": "<DataRegion>", "ResourceQuota": "12CU", "WorkspaceOption": "CreateNewInstance", "WorkspaceName": "<WorkspaceName>", "DatabaseOption": "CreateNewInstance", "DbInstanceAccount": "<account>", "DbInstancePassword": "<password>", "KvStoreOption": "CreateNewInstance", "KvStoreAccount": "<account>", "KvStorePassword": "<password>", "VectordbOption": "CreateNewInstance", "VectordbAccount": "<account>", "VectordbPassword": "<password>", "StorageType": "cloud_essd",scripts/openAPI_call.py:8-13:python args = sys.argv[1:] if len(args) != 1: print("Please provide a JSON-formatted string as a command-line argument") exit(1) json_body: Dict[str, Any] = json.loads(args[0])Technical Analysis
The documented execution flow requires the complete provisioning request, including the database, KV-store, and vector-database passwords, to be supplied as a command-line argument. The script then reads that plaintext JSON from
sys.argv.Command-line arguments are not a secure secret transport mechanism. Depending on the operating system and process isolation settings, they can be visible through process inspection facilities such as
/proc,ps, endpoint monitoring, job runners, or process audit logs. If a user manually enters the documented command with literal credentials, it may also be reta ...[truncated 1540 chars]- Remediation
View remediation
Remediation Suggestions
- Stop accepting password-bearing JSON through
sys.argv. - Accept non-secret request data through standard input or a configuration file with restrictive permissions.
- Collect passwords separately using
getpass.getpass()for interactive use, or resolve them from an approved secret manager for automation. - If file input is supported, require owner-only permissions, avoid predictable temporary files, and securely delete temporary material after use.
- Update
SKILL.mdso no example places passwords directly in a command invocation. - Ensure agent, CI, and SDK logging redacts all password fields.
- Use separate credentials for each backing service where supported, and rotate any credentials previously supplied through the documented command-line flow.
- Stop accepting password-bearing JSON through