T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:38
- Finding
- OAuth Secrets Are Exposed in Request URLs and Unnecessarily Persisted<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 38–50 **Vulnerability Type**: Sensitive information exposure and unnecessary secret persistence **Risk Level**: Medium ### Vulnerable Code ```powershell # Provide: $appId, $appSecret, $shortToken (from Graph API Explorer), $pageId # 1. Exchange for long-lived user token $r1 = Invoke-RestMethod "https://graph.facebook.com/oauth/access_token?grant_type=fb_exchange_token&client_id=$appId&client_secret=$appSecret&fb_exchange_token=$shortToken" # 2. Get never-expiring Page token $r2 = Invoke-RestMethod "https://graph.facebook.com/v25.0/$pageId?fields=access_token&access_token=$($r1.access_token)" $pageToken = $r2.access_token # 3. Save — only these four fields, nothing else @{ FB_PAGE_ID = $pageId FB_PAGE_TOKEN = $pageToken FB_APP_ID = $appId FB_APP_SECRET = $appSecret } | ConvertTo-Json | Set-Content "$HOME/.config/fb-page/credentials.json" -Encoding UTF8 ``` ### Technical Analysis The token-exchange request places the Meta App Secret and short-lived access token directly in the URL query string. The subsequent request likewise places the long-lived user token in its URL. Although HTTPS encrypts the request in transit, query strings may be retained by PowerShell transcripts, command-history or diagnostic systems, exception records, monitoring products, or HTTP proxies. Consequently, sensitive credentials can escape the intended process boundary without any compromise of TLS. The setup then writes `FB_APP_SECRET` to the operational credential file even though the Skill explicitly states that only `FB_PAGE_TOKEN` and `FB_PAGE_ID` are required for ordinary API calls. The agent rules later instruct users to remove the App Secret, confirming that its long-term persistence is not necessary for the declared functionality. Saving it first and relying on later manual deletion expands the credential exposure window and violates least-secret-storage principles. The file-permiss ...[truncated 1861 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Do not persist one-time setup secrets.** Write only the fields needed during routine execution: ```powershell @{ FB_PAGE_ID = $pageId FB_PAGE_TOKEN = $pageToken } | ConvertTo-Json | Set-Content "$HOME/.config/fb-page/credentials.json" -Encoding UTF8 ``` 2. **Keep `FB_APP_SECRET`, `FB_APP_ID`, and the short-lived user token in memory only.** Clear the variables after exchange where practical, and never include them in the operational credential file. 3. **Avoid putting credentials in URLs.** Submit token-exchange parameters in a request body when supported by the Meta endpoint: ```powershell $r1 = Invoke-RestMethod ` -Uri "https://graph.facebook.com/oauth/access_token" ` -Method POST ` -Body @{ grant_type = "fb_exchange_token" client_id = $appId client_secret = $appSecret fb_exchange_token = $shortToken } ` -ErrorAction Stop ``` Use request bodies or authorization headers for subsequent access tokens wherever supported by the Graph API. 4. **Create and secure the credential directory before writing the file.** Apply restrictive directory permissions first, write through a securely permissioned temporary file, and atomically replace the destination to minimize exposure windows. 5. **Disable or redact sensitive logging during setup.** Ensure PowerShell transcription, verbose output, exception reporting, and proxy logging do not capture authorization headers, request bodies, or token-bearing URLs. 6. **Update all documentation and metadata consistently.** Remove `FB_APP_SECRET` and `FB_APP_ID` from the saved credential schema in `README.md`, `SKILL.md`, and `_meta.json`, documenting them only as transient setup inputs. 7. **Rotate potentially exposed credentials.** Users who previously followed the documented procedure should remove the stored App Secret, rotate or revoke the Page token, and inspect relevant transcripts, logs, and backups fo ...[truncated 25 chars]