T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:27- Finding
Umami Administrator Password Exposed in Shell Command Arguments and History
- Content
View full analysis
/api/auth/login" \ -H "Content-Type: application/json" \ -d '{"username":"admin","password":""}' \ | python3 -c "import json,sys; print(json.load(sys.stdin)['token'])") ``` ### Technical Analysis The instructions encourage the operator to substitute the Umami administrator password directly into a command-line argument. If entered literally, the credential may be retained in the user's shell history. While the command is executing, the password may also be visible through operating-system process inspection interfaces to other sufficiently privileged local users or processes. The resulting bearer token is stored in the `TOKEN` shell variable and reused by subsequent API requests. This is functionally necessary for authentication, but it extends the lifetime of sensitive authentication material within the shell environment. No hardcoded real credential is included in the project; the risk arises from the documented credential-handling pattern. ### Attack Path 1. An operator replaces `` with the real Umami administrator password and runs the documented command. 2. The literal command is recorded in shell history or becomes temporarily available through local process-argument inspection. 3. A local attacker, malicious process, or another account with sufficient access reads the exposed credential. 4. The attacker authenticates to the configured Umami instance using the administrator credentials. 5. The attacker accesses or modifies websites and analytics data within the permissions granted to that administrator account. This attack requires access to the operator's local shell history, account, or process information; the documentation does not independently transmit the credential to an unrelated third party. ### Impact Ass ...[truncated 633 chars]- Remediation
View remediation