T09 · Insecure Skill Coding Practices
Warning
- Location
- cli.ts:27
- Finding
- Wallet Private Key Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `cli.ts:27-38` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```ts program .name("agent-market") .description("CLI for Autonomous Agents") .version("0.1.0") .option("--rpc <url>", "Override RPC URL", DEFAULT_RPC) .option("--key <private_key>", "Override Private Key"); function getProvider(options: any) { const rpc = options.rpc || process.env.BASE_RPC_URL || DEFAULT_RPC; return new ethers.JsonRpcProvider(rpc); } function getWallet(options: any, provider: ethers.JsonRpcProvider) { const key = options.key || process.env.PRIVATE_KEY; if (key) return new ethers.Wallet(key, provider); return null; } ``` ### Technical Analysis The CLI accepts a complete wallet private key through the `--key` command-line option. Command-line arguments are not a secure credential transport mechanism. Depending on the operating system and execution environment, arguments can be exposed through: - Shell history files. - Process inspection utilities and process metadata. - Terminal session recordings. - Audit, endpoint monitoring, or orchestration logs. - Agent execution traces and diagnostic output. - Wrapper scripts or automation configuration. The key is used to instantiate an `ethers.Wallet`, granting the process unrestricted signing authority for that wallet. Although the reviewed code does not transmit the raw private key to the RPC endpoint, disclosure through local process metadata is sufficient to compromise the wallet. This credential access is required for signing transactions, but accepting the credential as a normal command-line argument exceeds the minimum privilege and secrecy controls necessary for that functionality. ### Attack Path 1. A user or autonomous agent invokes the CLI with `neo-market --key 0x...`. 2. The complete private key is recorded in shell history, execution telemetry, process arguments, or an ...[truncated 891 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `--key` command-line option entirely. 2. Support protected signing mechanisms such as: - Encrypted JSON keystores with a hidden password prompt. - Hardware wallets. - OS-native credential stores. - External signers that do not expose raw key material to the CLI. 3. If interactive key entry is necessary, use a no-echo terminal prompt and retain the key only in memory for the minimum required duration. 4. Avoid recommending persistent plaintext `.env` files for valuable wallet keys. 5. If environment-variable support remains available, clearly warn that inherited environments, crash reports, and child processes can expose the value. 6. Encourage use of a dedicated, least-value operational wallet rather than a primary wallet. 7. Add automated tests ensuring that private keys are never printed, included in errors, or accepted through process arguments. ]]>