T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/account.mjs:61
- Finding
- API Token Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/account.mjs:61-67` **Vulnerability Type**: API credential disclosure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```js if (args['import-token']) { const token = typeof args['import-token'] === 'string' ? args['import-token'] : ''; if (!token) { console.error('错误：--import-token 需要提供 Token 值'); process.exit(1); } const savePath = writeToken(token); ``` The insecure invocation method is also explicitly documented in `SKILL.md:59`: ```text | `--import-token <token>` | 直接保存 Token（无需交互）。 | ``` ### Technical Analysis The `--import-token` option requires the user to place a KreadoAI API token directly in the command line. Command-line arguments are not an appropriate secret-input channel because they may be: - Retained in shell history files. - Visible to local process-inspection utilities while the process is running. - Collected by process monitoring, audit, telemetry, or diagnostic systems. - Preserved in automation logs or command transcripts. The application subsequently masks the token in its own output, but this does not protect the original command line. The exposure is avoidable because the Skill already supports interactive credential entry and the `KREADO_API_TOKEN` environment variable. ### Attack Path 1. A user configures the Skill using the documented command form: ```bash node scripts/kreado.mjs account --import-token REAL_API_TOKEN ``` 2. The shell records the complete command, including the token, in its history, or a local process-monitoring utility captures the process arguments. 3. A local user, monitoring agent, support bundle, or log reader with access to that data retrieves the token. 4. The exposed token is reused against the KreadoAI API. 5. The attacker can perform operations authorized for the affected KreadoAI account until the token is revoke ...[truncated 534 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `--import-token <token>` option and its examples from `SKILL.md` and command help. 2. Prefer hidden interactive entry that disables terminal echo. The current `readline.question` configuration visibly echoes input, so it should be replaced with a secret-input implementation. 3. For non-interactive use, accept the token through a protected file descriptor, standard input, operating-system credential store, or secret manager rather than a command-line value. 4. If file-based import is required, accept only a path to a permission-restricted secret file and validate its ownership and permissions before reading it. 5. Warn existing users to remove commands containing tokens from shell histories and automation logs, then rotate any token previously supplied through `--import-token`. 6. Continue storing the credential file with restrictive permissions and fail securely if those permissions cannot be applied.