T09 · Insecure Skill Coding Practices
Error
- Location
scripts/solve_feishu_integration.py:346- Finding
User-supplied Feishu credentials are embedded in generated source files
- Content
View full analysis
str: os.makedirs(self.solutions_dir, exist_ok=True) language = solution['language'] problem_type = solution['problem_type'] solution_id = f"{language}_{problem_type}_{len(os.listdir(self.solutions_dir)) + 1}" solution_path = os.path.join(self.solutions_dir, f"{solution_id}.{language}") if solution['source'] == 'official': code = self._generate_official_implementation(solution, config) elif solution['source'] == 'community': code = self._generate_community_implementation(solution, config) else: code = self._generate_manual_implementation(solution, config) with open(solution_path, 'w', encoding='utf-8') as f: f.write(code) return solution_path def _generate_official_implementation(self, solution: Dict[str, Any], config: Dict[str, Any]) -> str: template = solution['solution']['code_template'] code = template for key, value in config.items(): placeholder = f"your_{key}" code = code.replace(placeholder, str(value)) return code ``` The official authentication template contains credential placeholders such as: ```python config = Config.new_config_with_memory_store( DOMAIN_FEISHU, app_id="your_app_id", app_secret="your_app_secret" ) ``` ### Technical Analysis The implementation directly substitutes every value supplied through `config` into generated source code. When `app_id` and `app_secret` are provided, the placeholders in the authentication template are replaced with their actual values. The resulting source file is then written to the workspace under the `solutions` directory. This stores authentication secrets in plaintext source code rat ...[truncated 1809 chars]- Remediation
View remediation