T09 · Insecure Skill Coding Practices
Error
- Location
scripts/superhero-wallet.mjs:19- Finding
Wallet Private Keys Are Exposed Through Process Arguments, Standard Output, and Plaintext Shell Configuration
- Content
View full analysis
'); process.exit(1); } const account = new MemoryAccount(secretKey); console.log(JSON.stringify({ success: true, address: account.address, next_step: `export AE_PRIVATE_KEY=${secretKey}`, warning: 'Save this private key securely. Back it up offline. Never commit it to git.', })); } ``` `guides/setup.md:21-40`: ```bash node {baseDir}/scripts/superhero-wallet.mjs generate ``` This outputs a new `AE_PRIVATE_KEY` and `address`. Set the environment variable before running any other script: ```bash export AE_PRIVATE_KEY= ``` For persistence across sessions, add it to `~/.zshenv` or `~/.profile` (never commit this to git). ```bash node {baseDir}/scripts/superhero-wallet.mjs import "" ``` ### Technical Analysis The wallet import interface accepts a private key as a positional command-line argument. Command-line arguments can be exposed through shell history, process inspection facilities, terminal recording, audit systems, job runners, and agent execution transcripts. Both wallet generation and w ...[truncated 2833 chars]- Remediation
View remediation