T09 · Insecure Skill Coding Practices
Warning
- Location
tencentmap-jsapi-gl-skill/scripts/create_key.py:93- Finding
Sensitive credentials exposed through command-line arguments and standard output
- Content
View full analysis
"}, ensure_ascii=False )) sys.exit(1) result = create_key(sys.argv[1], sys.argv[2], sys.argv[3]) print(json.dumps(result, ensure_ascii=False)) ``` From `supplement_key.py`: ```python token = sys.argv[1] action = sys.argv[2] mkey = sys.argv[3] if len(sys.argv) > 3 else "" result = supplement(token, action, mkey) print(json.dumps(result, ensure_ascii=False)) ``` From `save_config.py`: ```python if len(sys.argv) >= 4 and sys.argv[2] != "--mark-expired": is_existing = False if len(sys.argv) >= 5: is_existing = sys.argv[4].lower() == "true" result = save_config(sys.argv[1], sys.argv[2], sys.argv[3], is_existing) ``` The documented invocation model is equivalent to: ```bash python3 scripts/create_key.py python3 scripts/supplement_key.py reuse python3 scripts/save_config.py ``` ### Technical Analysis The workflow places phone numbers, SMS verification codes, session tokens, supplement tokens, and full Tencent Maps API keys in process command-line arguments. Depending on the operating system and execution environment, command lines can be exposed through: ...[truncated 2245 chars]- Remediation
View remediation