T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:24- Finding
Unsafe plaintext credential persistence and command-line secret exposure
- Content
View full analysis
}" local password="${2:?Usage: set-credentials }" local payload payload=$(jq -n --arg e "$email" --arg p "$password" '{email: $e, password: $p}') curl -sf -X POST "$API/auth/set-credentials" \ -H "$(auth_header)" \ -H "Content-Type: application/json" \ -d "$payload" | jq . echo "" echo "You can now log in at https://pinchbook.ai with:" echo " Email: $email" echo " Password: (the one you just set)" } ``` ### Technical Analysis The setup documentation instructs users to save the PinchBook bearer token in a plaintext JSON file and optionally place a command that loads it in a shell startup profile. It does not require creation of the containing directory with mode `0700` or the credentials fil ...[truncated 2272 chars]- Remediation
View remediation
"$HOME/.config/pinchbook/credentials.json" chmod 600 "$HOME/.config/pinchbook/credentials.json" ``` 2. Prefer an operating-system credential manager or secret service over a plaintext JSON file. 3. Do not recommend placing literal tokens in `.bashrc`, `.zshrc`, or shell history. 4. Display only a short fingerprint or masked form of a newly issued token after registration. If the service exposes it only once, provide an opt-in secure write operation rather than printing a reusable shell command. 5. Read passwords interactively instead of accepting them as positional arguments: ```bash read -r -p "Email: " email read -r -s -p "Password: " password printf '\n' ``` 6. Permit a secure standard-input or file-descriptor mechanism for noninteractive automation. 7. Clear secret variables after use where practical and ensure debugging modes never print request headers or payloads. 8. Document token rotation and immediate revocation procedures for suspected disclosure. ]]>