T09 · Insecure Skill Coding Practices
Warning
- Location
client.js:3- Finding
Bearer Authentication Tokens Exposed Through Command-Line Arguments
- Content
View full analysis
``` ```bash node client.js action ``` The long-running gatekeeper mode also retains the token in `process.argv` and reuses it when entering the play loop at `client.js:137-140`: ```js if (matchId) { // We reuse the play logic process.argv = [process.argv[0], process.argv[1], 'play', matchId, botId, token]; await run(); } ``` ### Technical Analysis Bearer tokens grant their holder the abi ...[truncated 2624 chars]- Remediation
View remediation
``` The implementation should verify that a token file has restrictive permissions before reading it. If an environment variable is used, documentation should warn that some process-launch environments and CI systems may record environment values. 4. **Avoid retaining secrets in `process.argv`.** Do not rewrite `process.argv` with the token when transitioning from `gatekeeper` to `play`. Refactor the shared play logic into a function and pass credentials through an in-memory parameter: ```js async function play(matchId, botId, token) { // Shared play implementation } ``` 5. **Prevent accidental disclosure.** Redact authorization values from errors, debug logs, telemetry, crash reports, and HTTP tracing. Continue avoiding printing the token in normal output. 6. **Support revocation and rotation.** Document how users can revoke a potentially exposed token and obtain a replacement. Tokens should be short-lived and scoped only to the minimum bot operations required by the Skill. 7. **Validate secure transport.** Continue using HTTPS for the declared API and do not disable TLS certificate verification. ]]>