T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/scan.sh:166
- Finding
- Raw Secret Values Are Exposed in Logs, JSON Reports, and Persistent Monitoring State<![CDATA[ ## Vulnerability Details **File Location**: `scripts/scan.sh:166-223`, `scripts/scan.sh:340-356`, `scripts/scan.sh:508-558`, `scripts/monitor.sh:96-109`, and `scripts/monitor.sh:121-128` **Vulnerability Type**: Plaintext sensitive-data exposure and insecure report storage **Risk Level**: High ### Vulnerable Code ```bash # scripts/scan.sh:166-223 grep_out=$(grep -rEn --exclude-dir=.git --exclude-dir=node_modules --exclude-dir=.venv \ --exclude-dir=venv --exclude-dir=__pycache__ --exclude-dir=.security-ops \ --exclude='*.example' --exclude='.env.example' --exclude='.env.*.example' \ "$GREP_PAT" \ --include='*.js' --include='*.ts' --include='*.py' --include='*.rb' \ --include='*.go' --include='*.java' --include='*.yaml' --include='*.yml' \ --include='*.json' --include='*.toml' --include='*.ini' --include='*.cfg' \ --include='*.conf' --include='*.sh' --include='*.env' --include='*.env.local' \ --include='*.tf' --include='*.tfvars' --include='*.properties' --include='*.xml' \ --include='*.md' --include='*.txt' \ --include='Makefile' --include='Procfile' --include='Vagrantfile' \ . 2>/dev/null | \ grep -v 'MARKER:agent-security-ops' | \ grep -v 'patterns\.md' || true) grep_count=$(count_lines "$grep_out") low_grep_out=$(grep -rEn --exclude-dir=.git --exclude-dir=node_modules --exclude-dir=.venv \ --exclude-dir=venv --exclude-dir=__pycache__ --exclude-dir=.security-ops \ --exclude='*.example' --exclude='.env.example' --exclude='.env.*.example' \ "$LOW_PAT" \ --include='*.js' --include='*.ts' --include='*.py' --include='*.rb' \ --include='*.go' --include='*.java' --include='*.yaml' --include='*.yml' \ --include='*.json' --include='*.toml' --include='*.ini' --include='*.cfg' \ --include='*.conf' --include='*.sh' --include='*.env' --include='*.env.local' \ --include='*.tf' --include='*.tfvars' \ . 2>/dev/null | \ grep -v 'MARKER:agent-security-ops' | \ grep -v 'patterns\.md' || true) low_grep_count=$(count_l ...[truncated 4739 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Never retain or print complete matched lines for secret findings. 2. Report only: - Relative file path. - Line number. - Secret provider or pattern type. - A non-reversible fingerprint, such as a salted SHA-256 digest. - A heavily masked preview, if operationally necessary. 3. Perform redaction before assigning data to `grep_out`, `low_grep_out`, `env_secrets_out`, or any JSON field. 4. For shell profiles, report only the profile path, line number, and environment-variable name. Do not include the assigned value. 5. Keep raw TruffleHog findings in ephemeral files only and ensure they are deleted on every exit path. 6. Create monitoring state with explicit permissions: ```bash install -d -m 700 "$STATE_DIR" umask 077 ``` 7. Explicitly apply mode `0600` after writing state files: ```bash chmod 600 "$LAST_SCAN" "$LAST_HASH" ``` 8. Add a safe reporting mode as the default and require an explicit, prominently warned option for any unredacted local troubleshooting output. 9. Document that security reports must not be uploaded as public CI artifacts or forwarded through cron email. 10. Add automated tests containing synthetic tokens and assert that no full token appears in stdout, stderr, or `.security-ops/last-scan.json`. ]]>