T09 · Insecure Skill Coding Practices
Warning
- Location
- playbook.md:22
- Finding
- Sensitive Personal Identifier Passed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `playbook.md`, lines 22–24 **Vulnerability Type**: Sensitive data exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash # 키 활성화 후 사용 # bash skills/pension-guide/scripts/nps_query.sh "[주민번호 앞자리]" ``` ### Technical Analysis The playbook suggests passing the first portion of a Korean resident registration number to a shell script as a command-line argument. Command-line arguments are not an appropriate channel for sensitive personal identifiers because they may be exposed through: - Shell command history - Process inspection utilities - Terminal session recording - Execution telemetry and audit logs - Wrapper scripts or automation logs - Error reporting and debugging output The referenced `nps_query.sh` script is not included in the project. Moreover, `scripts/README.md` states that personal pension estimates cannot be retrieved through a public REST API because authenticated access is required. The documented command therefore creates unnecessary privacy risk without a supported functional purpose. No command injection is demonstrated because the referenced script is absent and its argument handling cannot be assessed. The confirmed issue is the unsafe recommendation to place a sensitive identifier in process arguments. ### Attack Path 1. A user or operator follows the command example in `playbook.md`. 2. The user replaces the placeholder with part of their resident registration number. 3. The shell records the command in history, or the execution environment captures the process arguments in logs or telemetry. 4. Another local user, administrator, support operator, log reader, or compromised monitoring component accesses the recorded command. 5. The exposed identifier may be correlated with other available personal information and used for privacy abuse or identity-focused social engineering. Exploitation requires the user to follow the documented example and an atta ...[truncated 614 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the command example that accepts a resident registration number. 2. Explicitly prohibit requesting or processing resident registration numbers for built-in pension estimates. 3. Direct users to the official authenticated pension portal at `https://csa.nps.or.kr` for personal records and exact estimates. 4. Use only non-sensitive inputs, such as age, contribution duration, and approximate average income, for local estimates. 5. If a legitimate authenticated integration is introduced later: - Apply strict data minimization. - Never pass sensitive values through command-line arguments. - Collect required values through a protected interactive prompt or secure credential mechanism. - Prevent values from appearing in logs, exceptions, telemetry, and shell history. - Keep sensitive values only in memory for the minimum necessary duration. - Document retention, access-control, and deletion requirements. 6. Remove references to nonexistent scripts or add validation ensuring that all documented integrations are implemented and security-reviewed before publication. ]]>