T09 · Insecure Skill Coding Practices
- Location
scripts/check-connection.sh:21- Finding
Partial Facebook Access Token Disclosure in Console Output
- Content
View full analysis
Vulnerability Details
File Location:
scripts/check-connection.sh, line 21
Vulnerability Type: Sensitive credential exposure through console output
Risk Level: MediumVulnerable Code
bash echo "🔑 Token: ${FACEBOOK_ACCESS_TOKEN:0:20}...${FACEBOOK_ACCESS_TOKEN: -10}"Technical Analysis
The connection-checking script prints the first 20 and last 10 characters of
FACEBOOK_ACCESS_TOKEN. Although it does not print the complete token, these 30 characters are sensitive credential material and should not be exposed.Standard output is frequently retained in shell histories, CI/CD job logs, agent transcripts, centralized logging platforms, monitoring systems, and support records. Anyone with access to those records can recover the disclosed token fragments and correlate them across environments or incidents. Partial disclosure can also reduce the effective secrecy of the credential.
The token is otherwise sent to Facebook's official Graph API using an HTTP authorization header; no unauthorized external transmission was identified.
Attack Path
- An administrator configures a valid Facebook Page access token in the
FACEBOOK_ACCESS_TOKENenvironment variable. - The administrator or an automated system executes
scripts/check-connection.sh. - The script prints 30 characters from the access token to standard output.
- The output is retained in an agent transcript, CI log, terminal capture, or centralized logging system.
- A user or service with access to those records obtains the exposed credential fragments.
- The fragments can be used to identify and correlate the token and may assist credential-recovery or token-compromise efforts when combined with another disclosure.
Impact Assessment
The issue directly exposes part of a privileged Facebook Page credential. The leaked fragment alone is not demonstrated to be sufficient to authenticate to Facebook, so this finding does not establish immediate account takeover.
...[truncated 466 chars]
- An administrator configures a valid Facebook Page access token in the
- Remediation
View remediation
Remediation Suggestions
- Remove all access-token fragments from console output. Replace the vulnerable line with a non-sensitive status message:
bash echo "🔑 Token: configured"-
If operators require a way to distinguish credentials, display only a short, non-reversible fingerprint rather than any substring of the token. Ensure that the fingerprint does not expose the original credential.
-
Review existing CI logs, agent transcripts, terminal recordings, and centralized logs for previously exposed token fragments. Restrict access to or securely delete affected records according to the applicable retention policy.
-
Rotate the Facebook Page access token if logs containing token fragments were accessible to unauthorized or untrusted parties.
-
Adopt a project-wide rule prohibiting full or partial secret values in diagnostic output, including API keys, access tokens, application secrets, and authorization headers.