T09 · Insecure Skill Coding Practices
Error
- Location
scripts/req_token.py:110- Finding
HPC Password Exposed Through Process Command-Line Arguments
- Content
View full analysis
[--workspace WORKSPACE] [--textfile TEXTFILE] Arguments: username: HPC account username password: HPC account password ``` ```python parser.add_argument("username", help="HPC account username") parser.add_argument("password", help="HPC account password") ``` The Skill documentation directs the Agent to invoke the script as follows: ```text req_token.py "username" "password" --workspace "path_to_workspace" --textfile "uploaded_file_path" ``` ### Technical Analysis The script accepts the user's HPC password as a positional command-line argument. Command-line arguments are not a secure secret transport mechanism. Depending on the operating system and execution environment, they can be exposed through: - Process inspection utilities and process metadata. - Shell history. - Agent command-execution logs and traces. - Audit or observability systems. - Error reports that reproduce the invoked command. - Other local processes or users with permission to inspect process information. The `--textfile` option does not mitigate this exposure because the implementation does not read the password from that file. The caller must still include the plaintext password in `args.password`. This behavior conflicts with the documentation’s stated objective of avoiding plaintext password leakage. Sending the password to the declared SJTU HPC HTTPS authentication endpoint is necessary for token acquisition, but exposing it in local process arguments is not necessary and exceeds the minimum secret exposure required by the functionality. ### Attack Path 1. A user follows the Skill instructions and provides an HPC password, potentially through an uploaded f ...[truncated 1372 chars]- Remediation
View remediation