T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/02-create-management-secrets.sh:17
- Finding
- Sensitive Hetzner credentials are exposed through command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/02-create-management-secrets.sh:17-22` **Vulnerability Type**: Sensitive credentials in process arguments **Risk Level**: High ### Vulnerable Code ```bash echo "==> Creating or updating 'hetzner' secret..." kubectl create secret generic hetzner \ --from-literal=hcloud="$HCLOUD_TOKEN" \ --from-literal=robot-user="$HETZNER_ROBOT_USER" \ --from-literal=robot-password="$HETZNER_ROBOT_PASSWORD" \ --dry-run=client -o yaml | kubectl apply -f - ``` ### Technical Analysis The script expands the HCloud API token, Robot username, and Robot password directly into the argument list of the `kubectl` process. Although the resulting manifest is sent through standard output to another `kubectl` process, the original secret values are still present in the process arguments. Depending on operating-system process visibility and host security configuration, these values may be accessible through process inspection, audit or endpoint-monitoring systems, command tracing, debugging tools, or crash diagnostics. The use of `set -x` by a caller would create an additional disclosure risk. Creating Kubernetes Secrets is necessary for the Skill's declared SySelf Autopilot workflow. However, placing secret values in process arguments is not the minimum-exposure method required to implement that functionality. ### Attack Path 1. An operator exports `HCLOUD_TOKEN`, `HETZNER_ROBOT_USER`, and `HETZNER_ROBOT_PASSWORD`. 2. The operator runs `scripts/02-create-management-secrets.sh`. 3. The script expands those values into the `kubectl create secret` process arguments. 4. A local process observer, privileged user, monitoring agent, or audit collector records or reads the argument list while the command is running. 5. The observer extracts the HCloud token and Robot credentials. 6. The exposed credentials are used against the corresponding Hetzner services, subject to their assigned privileges. ### Impact Assessment Disclo ...[truncated 502 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not pass secret values through `--from-literal` command-line arguments. - Prefer a Kubernetes client library or another implementation that constructs the Secret in memory and transmits it without placing credentials in process arguments. - If file-based handling is required, create protected temporary files with mode `0600`, use a private directory, ensure cleanup through a shell trap, and avoid exposing generated Secret YAML in logs. - Explicitly prohibit shell tracing while credentials are processed and fail if an unsafe debugging mode is active. - Ensure logs and monitoring systems never capture generated Secret manifests or sensitive environment-variable values. - Use narrowly scoped, separately managed credentials where supported, and rotate the HCloud token and Robot password after any suspected disclosure. ]]>