T09 · Insecure Skill Coding Practices
Error
- Location
README.md:49- Finding
Private Key Exposure Through Incorrect Command-Line Documentation
- Content
View full analysis
``` ``` The command table repeats the unsafe interface: ```markdown | `init [url]` | Initialize wallet | ``` The actual implementation interprets the first argument as a server URL rather than a private key: ```javascript async function cmdInit(serverUrl) { const existing = loadConfig(); if (existing) { const { sdk } = await getSDK(); const { Wallet, SingleKey } = sdk; const wallet = await Wallet.create({ identity: SingleKey.fromHex(existing.privateKey), arkServerUrl: existing.serverUrl || DEFAULT_SERVER, }); const address = await wallet.getAddress(); console.log("Wallet already initialized."); console.log(`Server: ${existing.serverUrl || DEFAULT_SERVER}`); console.log(`Address: ${address}`); return; } try { const config = await autoInit(serverUrl); ``` ### Technical Analysis The README explicitly directs users to place a Bitcoin private key in a command-line argument. Command-line secrets can be exposed through: - Shell history files - Process listings and process-monitoring utilities - Terminal session recording - CI/CD logs - Agent transcripts and tool-call logs - Audit and telemetry systems The implementation makes the issue more dangerous because `cmdInit` does not import the supplied private key. It treats the argument as `serverUrl` and independently generates a new wallet through `autoInit`. A user may consequently disclose an existing wallet key while unknowingly initializing a different wallet. This violates secure secret-entry principles: cryptographic credentials must not be accepted or requested through process arguments. ### Attack Path 1. A user follows the README ...[truncated 1210 chars]- Remediation
View remediation