T09 · Insecure Skill Coding Practices
Warning
- Location
form_fill.sh:8- Finding
Sensitive form data exposed through command-line arguments
- Content
View full analysis
# # Example: # ./form_fill.sh application.pdf '{"full_name": "Jane Doe", "dob": "1990-03-15"}' if [ $# -lt 2 ]; then echo "Usage: $0 ''" >&2 echo "Example: $0 form.pdf '{\"name\": \"Jane Doe\"}'" >&2 exit 1 fi PDF_PATH="$1" FORM_FIELDS="$2" ``` ### Technical Analysis The shell interface requires all form values to be supplied as the second command-line argument. The Skill documentation demonstrates form data that can include names, dates of birth, addresses, Social Security numbers, income, insurance details, and other sensitive information. Command-line arguments are not an appropriate transport for such data because they may be: - Recorded in interactive shell-history files. - Visible to local process-inspection tools while the command is running. - Captured by process accounting, endpoint monitoring, audit systems, or terminal-session recording. - Retained in CI/CD logs or Agent execution transcripts. Quoting the JSON prevents shell expansion but does not prevent history or process-list exposure. The network upload is necessary for the declared cloud form-filling functionality, but placing sensitive values directly in process arguments exceeds the minimum local exposure necessary to perform that upload. ### Attack Path 1. A user follows the documented usage and invokes the script with PII embedded in the JSON command-line argument. 2. The shell records the complete command in its history, or a local monitoring facility captures the process arguments. 3. A local user, administrator, monitoring operator, compromised process, or later reader of archived logs accesses the recorded command. 4. The attacker extracts the form values without n ...[truncated 595 chars]- Remediation
View remediation