T09 · Insecure Skill Coding Practices
Warning
- Location
cli.ts:27- Finding
Wallet Private Key Exposed Through Command-Line Arguments
- Content
View full analysis
", "Override RPC URL", DEFAULT_RPC) .option("--key ", "Override Private Key"); function getProvider(options: any) { const rpc = options.rpc || process.env.BASE_RPC_URL || DEFAULT_RPC; return new ethers.JsonRpcProvider(rpc); } function getWallet(options: any, provider: ethers.JsonRpcProvider) { const key = options.key || process.env.PRIVATE_KEY; if (key) return new ethers.Wallet(key, provider); return null; } ``` ### Technical Analysis The CLI accepts a complete wallet private key through the `--key` command-line option. Command-line arguments are not a secure credential transport mechanism. Depending on the operating system and execution environment, arguments can be exposed through: - Shell history files. - Process inspection utilities and process metadata. - Terminal session recordings. - Audit, endpoint monitoring, or orchestration logs. - Agent execution traces and diagnostic output. - Wrapper scripts or automation configuration. The key is used to instantiate an `ethers.Wallet`, granting the process unrestricted signing authority for that wallet. Although the reviewed code does not transmit the raw private key to the RPC endpoint, disclosure through local process metadata is sufficient to compromise the wallet. This credential access is required for signing transactions, but accepting the credential as a normal command-line argument exceeds the minimum privilege and secrecy controls necessary for that functionality. ### Attack Path 1. A user or autonomous agent invokes the CLI with `neo-market --key 0x...`. 2. The complete private key is recorded in shell history, execution telemetry, process arguments, or an ...[truncated 891 chars]- Remediation
View remediation