T09 · Insecure Skill Coding Practices
Warning
- Location
tencentmap-jsapi-gl-skill/scripts/create_key.py:84- Finding
Sensitive authentication values are passed through command-line arguments
- Content
View full analysis
"}, ensure_ascii=False )) sys.exit(1) result = create_key(sys.argv[1], sys.argv[2], sys.argv[3]) print(json.dumps(result, ensure_ascii=False)) sys.exit(0 if result["error"] == 0 else 1) ``` The documented workflow also invokes related scripts as follows: ```bash python3 scripts/send_code.py python3 scripts/create_key.py python3 scripts/supplement_key.py reuse python3 scripts/save_config.py ``` ### Technical Analysis The workflow places phone numbers, SMS verification codes, session tokens, supplement tokens, and Tencent Maps API keys directly in command-line arguments. Process arguments can be exposed through process inspection facilities, execution telemetry, audit logs, crash reports, shell wrappers, or orchestration systems. Although the values are sent only to the documented Tencent endpoint over HTTPS, command-line transport unnecessarily expands their local exposure. Authentication tokens and verification codes should be treated as secrets even when they are short-lived. This behavior is not required by the declared functionality. The scripts can perform the same operation while reading sensitive fields from standard input, an inherited file descriptor, or another protected inter-process channel. ### Attack Path 1. A user starts the documented temporary-key enrollment workflow. 2. The Agent invokes `create_key.py`, `supplement_key.py`, or `save_config.py` with sensitive values in `ar ...[truncated 985 chars]- Remediation
View remediation