T09 · Insecure Skill Coding Practices
- Location
SKILL.md:95- Finding
Feishu Application Secret Exposed Through Command Output and Process Arguments
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 95–120
Vulnerability Type: Credential exposure through terminal output, execution logs, shell history, and process arguments
Risk Level: MediumVulnerable Code
bash python3 （请参考skill目录中的脚本文件） <file_path> <open_id> <app_id> <app_secret> [file_name]bash grep -A 2 '"feishu"' /root/.skill-platform/skill-platform.json | grep -E '(appId|appSecret)'bash python3 /root/.skill-platform/workspace/skills/feishu-send-file/（请参考skill目录中的脚本文件） \ /root/myfiles/report.html \ ou_abc123def456 \ cli_a1b2c3d4e5f6g7h8 \ secretAbCdEfGhIjKlMnOp \ weekly-report.htmlTechnical Analysis
The documented workflow retrieves both the Feishu application ID and application secret by printing matching configuration entries to standard output. In an AI-agent environment, this output may be retained in execution logs, conversation transcripts, terminal scrollback, or platform telemetry.
The workflow then passes
app_secretas a positional command-line argument. On systems where process metadata is visible to other users or monitoring services, the secret may be exposed through process listings such as/proc/*/cmdlineorps. It may also remain in shell history and command audit records after execution.Although the credential values shown in the example appear illustrative rather than confirmed live secrets, users are explicitly instructed to substitute their actual Feishu credentials into these unsafe channels. The secret is not required to be printed or supplied as a process argument to perform the legitimate file-upload operation.
Attack Path
- A user follows the skill instructions and runs the recommended
grepcommand againstskill-platform.json. - The real
appSecretis written to terminal output and potentially retained by the Agent platform, execution logger, or transcript system. - The user invokes the referenced Python script with the application secret a ...[truncated 1137 chars]
- A user follows the skill instructions and runs the recommended
- Remediation
View remediation
Remediation Suggestions
- Remove
app_secretfrom all positional command-line interfaces. - Have the implementation read credentials directly from a secret manager or a permission-restricted configuration file without printing them.
- If environment variables must be supported, read the secret within the process and ensure that commands, debugging output, exceptions, and execution logs never echo its value.
- Replace the configuration lookup command with a mechanism that confirms credential presence without displaying the secret.
- Redact credentials in Agent transcripts, shell tracing, telemetry, and error messages.
- Prevent shell history retention for any unavoidable credential-handling operation, while recognizing that this does not mitigate process-list exposure.
- Restrict the credential file to the service account that needs it, such as with mode
0600, and apply least-privilege Feishu API scopes. - Rotate the application secret if the documented commands have already been used with a real credential in a logged environment.
- Include the referenced script in the package and implement secure credential loading rather than requiring users to improvise the missing implementation.
- Remove