T09 · Insecure Skill Coding Practices
- Location
scripts/fetch-hotlist.py:25- Finding
Authenticated Session Cookies Stored in Tracked Source Code
- Content
View full analysis
Vulnerability Details
File Location:
scripts/fetch-hotlist.py, lines 25-29 and 116-124
Related Instructions:SKILL.md, lines 35-36;references/platform-hotlist-api.md, lines 12-18 and 55-59
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: MediumVulnerable Code
python # Optional: enter cookies here (Douyin and Xiaohongshu require them) COOKIES = { "douyin": "", # Enter Douyin Cookie "xiaohongshu": "", # Enter Xiaohongshu Cookie }The configured Douyin cookie is subsequently retrieved and transmitted as an authentication header:
python def fetch_douyin(): """Douyin hot list (requires Cookie)""" cookie = COOKIES.get("douyin", "") if not cookie: return {"platform": "抖音热榜", "error": "未配置 Cookie，请在脚本顶部 COOKIES['douyin'] 填入抖音 Cookie", "items": []} data = fetch_url( "https://www.douyin.com/aweme/v1/web/hot/search/list/?device_platform=webapp&aid=6383", extra_headers={"Cookie": cookie, "Referer": "https://www.douyin.com/"} )Technical Analysis
The project instructs users to copy authenticated browser cookies directly into a Python source file. Browser cookies can contain reusable session credentials that grant access to an authenticated account without requiring the account password.
Although the distributed values are currently empty and the script sends the Douyin cookie only to the expected HTTPS Douyin domain, populating this dictionary creates a plaintext secret inside the project directory. Such credentials can be unintentionally exposed through source-control commits, repository archives, backups, support bundles, shared project folders, or access by other local processes and users.
This is a conditional credential-exposure vulnerability: exploitation requires a user to follow the documented configuration instructions and place a valid session cookie in the source file. No ...[truncated 1339 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
COOKIEScredential dictionary from tracked source code. - Load credentials from environment variables, such as
DOUYIN_COOKIEandXIAOHONGSHU_COOKIE. - Prefer an operating-system credential manager or permission-restricted secret store for persistent credentials.
- If local configuration files are supported, provide an example file containing placeholders only, exclude the real file through
.gitignore, and restrict its filesystem permissions. - Never print, serialize, or include cookie values in exception messages or diagnostic logs.
- Update
SKILL.mdandreferences/platform-hotlist-api.mdso they no longer instruct users to edit tracked source files with live credentials. - Add automated secret scanning to development and release workflows to detect accidentally committed cookies.
- Document cookie rotation and revocation procedures. Any cookie previously committed or shared should be invalidated immediately.
- Where supported, use narrowly scoped, short-lived API credentials instead of full browser session cookies.
- Remove the