T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/authenticateEmail.ts:64
- Finding
- Password Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authenticateEmail.ts:64-74` **Vulnerability Type**: Plaintext credential exposure through process arguments **Risk Level**: High ### Vulnerable Code ```typescript // Example usage when run directly if (import.meta.url === `file://${process.argv[1]}`) { const args = process.argv.slice(2); if (args.length < 2) { console.error("Usage: npm run auth:email <email> <password>"); process.exit(1); } const [email, password] = args; authenticateWithEmail(email, password) ``` The same invocation pattern is prescribed in `SKILL.md:45-50` and `README.md:36-40`. ### Technical Analysis The authentication script obtains the Zion account password directly from `process.argv`. Command-line arguments are not an appropriate secret-input channel because they may be exposed through: - Shell history files. - Process inspection utilities while the command is running. - Terminal session recording. - CI/CD and automation logs. - Command auditing and endpoint monitoring software. - Parent-process telemetry. The script then sends the supplied credentials to the declared Zion Meta API over HTTPS. Sending credentials to that authentication service is expected functionality; the vulnerability is exposing the password locally before transmission. ### Attack Path 1. A user follows the documented command and supplies an email address and password as command-line arguments. 2. The shell records the command in its history, or another local process observes the active process arguments. 3. A local attacker, support bundle, monitoring agent, or compromised process retrieves the plaintext password. 4. The attacker authenticates directly to Zion using the stolen account credentials. 5. The attacker may access every project and platform capability authorized to that developer account, rather than only the project being used by the Skill. ### Impact Assessment Successful exploitation exposes the user's reus ...[truncated 279 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Read the password from an interactive hidden TTY prompt rather than `process.argv`. - Support protected standard input for noninteractive automation. - Do not recommend environment variables as the primary alternative because they can also leak through diagnostics and process configuration. - Remove all password-bearing command examples from `README.md` and `SKILL.md`. - Ensure authentication errors never include submitted credentials. - Advise affected users to clear relevant shell history and rotate passwords if the documented command has already been used. ]]>