T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/jimeng.sh:13- Finding
Volcengine Secret Key Exposed Through Process Command-Line Arguments
- Content
View full analysis
") sys.exit(1) ak = sys.argv[1] sk = sys.argv[2] ``` ### Technical Analysis The shell script passes `VOLCENGINE_AK` and `VOLCENGINE_SK` to `sign.py` as command-line arguments. Command-line arguments may be exposed through operating-system process inspection interfaces such as `/proc//cmdline`, process-monitoring utilities, audit services, diagnostic tooling, or command telemetry. The exposure window lasts while the signing process is running. Exploitation therefore requires local process visibility or access to process-monitoring records. The exact visibility boundary depends on operating-system configuration, user separation, `/proc` mount options, and monitoring permissions. Although the credentials initially come from environment variables, copying them into `argv` unnecessarily increases exposure because complete process command lines are frequently collected and retained by operational tooling. ### Attack Path 1. A user invokes `jimeng.sh` with valid Volcengine credentials in `VOLCENGINE_AK` and `VOLCENGINE_SK`. 2. `generate_auth_header` starts `sign.py`, placing both credentials in the child process command line. 3. A local attacker or monitoring component with permission to inspect that process reads its command-line arguments while it is running, or retrieves them from collected process telemetry. 4. The attacker extracts the access key an ...[truncated 661 chars]- Remediation
View remediation