T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:188- Finding
Bucket recovery phrase and root authorization key exposed through command-line arguments
- Content
View full analysis
" \ --account "" \ --url w3s \ --duration 0 \ --bucket "" \ --passphrase "<12_WORD_SEED_PHRASE>" \ --permissions 1,2,3 \ --output json \ --quiet ``` ```bash npx ts-node {baseDir}/grant-cli.ts \ --mode per-bucket \ --zkey "" \ --account "" \ --url w3s \ --duration 0 \ --bucket "" \ --passphrase "<12_WORD_SEED_PHRASE>" \ --permissions 1,3 \ --output json \ --quiet ``` The CLI consumes these sensitive values directly from its argument vector: ```typescript const zkey = getArg(args, "zkey"); const account = getArg(args, "account"); const url = getArg(args, "url") || "w3s"; const duration = parseInt(getArg(args, "duration") || "0", 10); if (!mode) throw new Error("--mode is required (per-bucket or all-buckets)"); if (!zkey) throw new Error("--zkey is required"); if (!account) throw new Error("--account is required"); if (mode === "per-bucket") { const bucketNames = args.get("bucket") || []; const passphrases = args.get("passphrase") || []; const permsList = args.get("permissions") || []; const prefixes = args.get("prefix") || []; if (bucketNames.length === 0) { throw new Error("--bucket is required for per-bucket mode"); } if (passphrases.length === 0) { throw new Error("--passphrase is required"); } } ``` ### Technical Analysis The documented deployment process places both the root ZKey and the 12-word bucket recovery phrase in the command-line argument vector. Command-line arguments are not an appropriate secret-transport channel because they may be exposed through: - Shell histo ...[truncated 1742 chars]- Remediation
View remediation