T09 · Insecure Skill Coding Practices
Error
- Location
scripts/zerofans-api.sh:46- Finding
Authentication secrets exposed through command-line arguments and response output
- Content
View full analysis
" exit 1 fi response=$(api_request "POST" "/auth/signup" "{\"email\": \"$email\", \"handle\": \"$handle\", \"password\": \"$password\"}") echo "$response" token=$(echo "$response" | grep -o '"token":"[^"]*"' | sed 's/"token":"\([^"]*\)"/\1/') if [ -n "$token" ]; then save_token "$token" echo "Token saved to $TOKEN_FILE" fi ;; login) shift email="${1:-}" password="${2:-}" if [ -z "$email" ] || [ -z "$password" ]; then echo "Usage: $0 login " exit 1 fi response=$(api_request "POST" "/auth/login" "{\"email\": \"$email\", \"password\": \"$password\"}") echo "$response" token=$(echo "$response" | grep -o '"token":"[^"]*"' | sed 's/"token":"\([^"]*\)"/\1/') if [ -n "$token" ]; then save_token "$token" echo "Token saved to $TOKEN_FILE" fi ;; ``` ### Technical Analysis The script requires users to supply account passwords as positional command-line arguments. Command-line arguments may be recorded in shell history and can be visible to local process-monitoring tools while the script is running. They may also be captured by automation systems, debugging utilities, terminal session recording, or job telemetry. The complete signup and login responses are printed through `echo "$response"` before the bearer token is extracted. If the API response includes the authentication token—as expected by the subsequent extraction logic—the token is disclosed in terminal scrollback, CI/CD logs, agent transcripts, or redirected output. The token is stored in `${HOM ...[truncated 1628 chars]- Remediation
View remediation
&2 IFS= read -r -s password printf '\n' >&2 ``` 2. Where supported, use a dedicated secret manager, protected environment file, or file descriptor rather than process arguments. Avoid ordinary environment variables for long-lived secrets because they may also be exposed through diagnostics. 3. Do not print complete authentication responses. Parse the response, store the token securely, and display only non-sensitive status information. 4. Use `jq` or another JSON parser rather than regular expressions to extract authentication fields: ```bash token=$(printf '%s' "$response" | jq -er '.token') ``` 5. Ensure errors are sanitized before printing because server error objects may reflect submitted values or contain sensitive diagnostic information. 6. Retain the existing `chmod 600` protection, but create the credential file atomically with a restrictive umask: ```bash umask 077 mkdir -p -- "$(dirname -- "$TOKEN_FILE")" printf '%s\n' "$credential_json" > "$TOKEN_FILE" ``` 7. Document token revocation and rotation procedures so accidentally logged credentials can be invalidated promptly. ]]>