T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:282- Finding
Hardcoded Passwords in Encryption Command Examples
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 282-307
Vulnerability Type: Hardcoded and exposed encryption credentials
Risk Level: MediumVulnerable Code
bash 7z a -t7z -mhe=on -p"MyStrongPassword123" -mx=9 \ sensitive_documents.7z \ /home/user/Documents/身份证.jpg \ /home/user/Documents/护照.jpg \ /home/user/Documents/财务报表.pdf 7z t sensitive_documents.7z -p"MyStrongPassword123" veracrypt --create /home/user/secure_volume.vc \ --size 1073741824 \ --password "MyContainerPassword" \ --hash sha512 \ --encryption AES \ --filesystem exFAT veracrypt --mount /home/user/secure_volume.vc /mnt/secure --password "MyContainerPassword"Technical Analysis
The examples place encryption passwords directly in command-line arguments. Although these appear to be example values rather than deployed secrets, users may copy them without substitution or adopt similarly predictable credentials.
Command-line secrets can be disclosed through:
- Shell history files.
- Process listings and system-monitoring tools while a command is running.
- Terminal logs, command auditing, and session recordings.
- Documentation, screenshots, support transcripts, or copied scripts.
- Process metadata collected by endpoint-management software.
Reusing the documented passwords would also make every archive or container created from the examples susceptible to trivial password guessing.
Attack Path
- A user copies the documented command to encrypt identity, passport, or financial documents.
- The user retains the example password or substitutes a real password directly in the command.
- The command and password are recorded in shell history or exposed through the process list.
- A local user, support operator, monitoring process, or attacker with access to the account reads the exposed command.
- The attacker obtains the encrypted archive or VeraCrypt container from lo ...[truncated 591 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove literal passwords from all commands and documentation.
- Allow 7-Zip and VeraCrypt to request passwords interactively without placing them in command-line arguments.
- If automation is essential, obtain credentials from an operating-system secret store or another access-controlled mechanism rather than embedding them in scripts.
- Warn users that environment variables may also be exposed and are not universally safe secret stores.
- Add an explicit warning that sample credentials must never be used for real data.
- Recommend a unique, randomly generated passphrase with adequate entropy.
- Advise users to clear any existing command history and rotate passwords that were previously passed on the command line.
- Avoid displaying secrets in logs, diagnostic output, screenshots, or exported execution records.