T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:54
- Finding
- Credential-bearing configuration is exposed to the Agent context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:54-63` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```markdown Run **both** commands — the `apiKey` field from `okx auth status --json` is the auth-binary's internal state and is always `false` regardless of whether `~/.okx/config.toml` has an API-key profile. `okx config show --json` is the only authoritative source for API-key presence. ```bash okx config show --json # reveals API-key profiles (TOML config) okx auth status --json # reveals OAuth session state (auth-binary state) ``` Apply **in this order** — first match wins: - `config show --json` has any profile with a non-empty `api_key` field → **API Key mode**. Proceed to Step B. ``` ### Technical Analysis The Skill requires both authentication commands to be executed before every authenticated operation. In particular, `okx config show --json` reads API-key profiles from the user's local OKX configuration and returns the result through the command-output channel visible to the Agent. The documented decision logic explicitly expects the Agent to inspect a non-empty `api_key` field. Therefore, the output is not described as a minimal Boolean status response, and the Skill does not establish that API keys, secrets, passphrases, or other sensitive profile fields are redacted before entering the Agent context. Authentication detection only requires profile names, environment information, and a Boolean indicating whether usable credentials exist. Returning complete profile objects violates least-privilege and data-minimization principles. ### Attack Path 1. A user requests any authenticated trading or account operation. 2. The Skill mandates execution of `okx config show --json`. 3. The CLI reads the user's credential profiles from `~/.okx/config.toml`. 4. The JSON output enters the Agent's tool context and may also be retained in transcripts or execut ...[truncated 926 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `okx config show --json` with a dedicated status command that returns only: - Profile name - Live or demo environment - Authentication method - Boolean credential-presence state 2. Ensure the CLI always masks API keys, secrets, passphrases, access tokens, refresh tokens, and session cookies before producing output. 3. Perform authentication checks inside the CLI process so raw configuration never enters the Agent context. 4. If a full configuration command must remain available, add an explicit redacted mode and require it in the Skill: ```bash okx config status --json ``` 5. Document and test redaction behavior. Add regression tests that fail if sensitive TOML fields appear in JSON output. 6. Avoid retaining authentication-status output in persistent transcripts or verbose logs. ]]>