T09 · Insecure Skill Coding Practices
- Location
SKILL.md:127- Finding
Collection and Persistent Handling of High-Value X Session Cookies
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 127
Vulnerability Type: Sensitive session credential handling
Risk Level: HighRelevant snippet (English translation of the documented instruction):
text The wizard sequentially performs: detection of Node/bird/PM2, guidance for extracting auth_token and ct0 from the browser, collection of active projects, configuration of notification preferences, and validation of the credentials.Technical Analysis
The documented setup workflow instructs users to extract the
auth_tokenandct0cookies from an authenticated X browser session. These are high-value session credentials:auth_tokenauthenticates the session, whilect0is commonly used as the corresponding CSRF token for authenticated requests.The Skill claims elsewhere that credentials are stored locally in an
.envfile with owner-only permissions and are not uploaded. However, the audited project contains onlySKILL.md; it does not contain the referenced setup script, package manifest, credential-storage implementation, or daemon source. Consequently, the audit cannot verify:- Atomic creation of the credential file with restrictive permissions.
- Prevention of credentials being inherited or exposed by child processes.
- Redaction of secrets from command output, PM2 logs, exceptions, and diagnostics.
- Exclusion of credential files from source control and backups.
- Restriction of network destinations receiving authenticated requests.
- Secure credential deletion, expiration, and rotation.
- The assertion that no telemetry or third-party credential transmission occurs.
Collecting raw browser-session cookies instead of using an official, narrowly scoped authorization mechanism increases the consequence of local file disclosure, process inspection, malicious dependencies, log leakage, or backup exposure.
Attack Path
- A user follows the setup instructions and extracts an active X
auth_tokenandct0...[truncated 1434 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace browser-cookie extraction with X's official OAuth flow wherever the required functionality is available.
- Request only the minimum scopes necessary to read bookmarks and avoid permissions for unrelated account actions.
- Ship the complete setup and daemon implementation so its credential handling and network behavior can be independently audited.
- If session cookies are unavoidable, display a prominent warning explaining that they are equivalent to active session credentials and may expose the user's account if disclosed.
- Create credential files atomically with owner-only permissions from the moment of creation; do not create a broadly readable file and restrict it afterward.
- Store credentials through the operating system's secret manager or a dedicated encrypted credential store rather than a plaintext
.envfile. - Ensure secrets are never included in command-line arguments, standard output, exception messages, PM2 logs, telemetry, crash reports, or diagnostic bundles.
- Explicitly validate that secret files are excluded from version control and common backup or synchronization workflows.
- Restrict outbound requests to documented X endpoints and clearly disclose every service that receives bookmark content or related user data.
- Implement credential rotation, revocation, expiry detection, and secure deletion procedures.
- Run the daemon as a dedicated, unprivileged account with narrowly restricted filesystem and network access.
- Add automated tests that inspect logs and error paths for accidental credential disclosure.