T09 · Insecure Skill Coding Practices
- Location
SKILL.md:165- Finding
Generated Passwords Are Stored in Plaintext
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:165-181
Vulnerability Type: Plaintext storage of authentication secrets
Risk Level: HighVulnerable Code
python def save_password(password, length): """保存密码到本地文件""" save_dir = "memory" os.makedirs(save_dir, exist_ok=True) save_path = os.path.join(save_dir, "passwords.md") timestamp = datetime.now().strftime("%Y-%m-%d %H:%M") entry = f""" ## {timestamp} - **随机密码** - 密码: `{password}` - 长度: {length} 位 - 强度: {evaluate_strength(password)} """ with open(save_path, 'a', encoding='utf-8') as f: f.write(entry) return save_pathThe associated configuration and documentation confirm that password history is intended to be stored at a predictable path:
python "save_history": True, "save_path": "memory/passwords.md"Technical Analysis
The
save_passwordfunction appends every generated password, in cleartext, to the predictable relative pathmemory/passwords.md. The file also records timestamps and password metadata.No encryption, operating-system credential vault, restrictive file-permission handling, retention limit, secure deletion mechanism, or explicit user-consent gate is implemented. Because append mode is used, repeated operation creates an accumulating credential archive.
This behavior conflicts with the document's security assertion that output does not contain keys or tokens. Although Python's
secretsmodule is appropriate for password generation, cryptographically secure generation does not protect a password after it is written unencrypted to disk.Attack Path
- A user invokes the Skill to generate a password.
- The user adopts that password for an account.
- The Skill passes the password to
save_password. - The complete password is appended to
memory/passwords.md. - A local process, another user with directory access, a collaborator, a backup or synchronization service, an accidental source-control c ...[truncated 793 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic password-history storage and set
save_historytoFalseby default. - Do not write generated passwords to Markdown, logs, command histories, telemetry, or other plaintext destinations.
- Return a generated password only through the minimum required protected interface and avoid displaying it longer than necessary.
- If persistence is explicitly requested, store the password in an operating-system credential vault or established password manager rather than a project file.
- If file-based persistence is unavoidable:
- Encrypt records using authenticated encryption.
- Protect encryption keys separately from the encrypted file.
- Create files with owner-only permissions.
- Add the storage path to source-control and backup exclusions.
- Apply short retention periods and provide reliable deletion controls.
- Require explicit user confirmation before every save.
- Remove existing plaintext password-history files and rotate every password that may have been recorded in them.
- Update the documentation so its sensitive-output claims accurately reflect actual behavior.
- Remove automatic password-history storage and set