T09 · Insecure Skill Coding Practices
Error
- Location
scripts/02-create-management-secrets.sh:17- Finding
Sensitive Hetzner credentials are exposed through command-line arguments
- Content
View full analysis
Creating or updating 'hetzner' secret..." kubectl create secret generic hetzner \ --from-literal=hcloud="$HCLOUD_TOKEN" \ --from-literal=robot-user="$HETZNER_ROBOT_USER" \ --from-literal=robot-password="$HETZNER_ROBOT_PASSWORD" \ --dry-run=client -o yaml | kubectl apply -f - ``` ### Technical Analysis The script expands the HCloud API token, Robot username, and Robot password directly into the argument list of the `kubectl` process. Although the resulting manifest is sent through standard output to another `kubectl` process, the original secret values are still present in the process arguments. Depending on operating-system process visibility and host security configuration, these values may be accessible through process inspection, audit or endpoint-monitoring systems, command tracing, debugging tools, or crash diagnostics. The use of `set -x` by a caller would create an additional disclosure risk. Creating Kubernetes Secrets is necessary for the Skill's declared SySelf Autopilot workflow. However, placing secret values in process arguments is not the minimum-exposure method required to implement that functionality. ### Attack Path 1. An operator exports `HCLOUD_TOKEN`, `HETZNER_ROBOT_USER`, and `HETZNER_ROBOT_PASSWORD`. 2. The operator runs `scripts/02-create-management-secrets.sh`. 3. The script expands those values into the `kubectl create secret` process arguments. 4. A local process observer, privileged user, monitoring agent, or audit collector records or reads the argument list while the command is running. 5. The observer extracts the HCloud token and Robot credentials. 6. The exposed credentials are used against the corresponding Hetzner services, subject to their assigned privileges. ### Impact Assessment Disclo ...[truncated 502 chars]- Remediation
View remediation