T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/register.sh:5
- Finding
- Bootstrap Token Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/register.sh`, lines 5 and 10 **Vulnerability Type**: Credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash echo "Usage: $0 <username> [bootstrap_token]" >&2 BOOTSTRAP_TOKEN="${2:-${LMFILES_BOOTSTRAP_TOKEN:-}}" ``` ### Technical Analysis The registration script explicitly supports passing the bootstrap token as its second positional argument. Secrets supplied through command-line arguments can be exposed through shell history, process inspection utilities, operating-system audit records, terminal logging, and process-monitoring systems. The environment-variable fallback does not eliminate the issue because the usage interface explicitly advertises and the implementation accepts the insecure positional-argument mechanism. No remote exploitation is established; exploitation requires access to command histories, process metadata, or associated logs on the system where the script runs. ### Attack Path 1. A user runs the documented interface: ```bash bash scripts/register.sh my-bot secret-bootstrap-token ``` 2. The shell may save the complete command in its history. While the command runs, the token may also appear in process metadata. 3. A local user, administrator, audit collector, monitoring service, or party with access to retained logs obtains the token. 4. The exposed token is submitted to the lmfiles.com account-registration endpoint. 5. If the token remains valid and permits additional registrations, the party can register an unauthorized account. ### Impact Assessment Successful exploitation discloses the bootstrap credential. Its practical scope is limited to the permissions and lifetime assigned to that token, principally unauthorized account registration. This issue does not directly expose `LMFILES_API_KEY`, grant local code execution, or provide operating-system privilege escalation. Rotation or invalidation of the bootstrap t ...[truncated 28 chars]
- Remediation
- ## Remediation Suggestions 1. Remove support for receiving the bootstrap token as a positional command-line argument. 2. Require the token through `LMFILES_BOOTSTRAP_TOKEN`, or read it interactively without terminal echo using `read -rs`. 3. Update the usage message so it does not advertise command-line secret submission. 4. Do not include real tokens in examples, shell history, logs, or diagnostic output. 5. Document immediate token rotation if exposure is suspected. 6. Where feasible, configure bootstrap tokens as single-use, narrowly scoped, and short-lived credentials. Example hardened approach: ```bash if [[ -z "${LMFILES_BOOTSTRAP_TOKEN:-}" ]]; then read -rsp "Bootstrap token: " BOOTSTRAP_TOKEN printf '\n' >&2 else BOOTSTRAP_TOKEN="$LMFILES_BOOTSTRAP_TOKEN" fi ``` Additionally, construct the registration request with a JSON-aware encoder, such as `jq -n --arg`, rather than direct string interpolation, so usernames or tokens containing quotes and control characters cannot produce malformed JSON.