T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:101
- Finding
- Unnecessary Duplication of the Entire Environment File## Vulnerability Details **File Location**: `SKILL.md`, lines 101-102 **Vulnerability Type**: Sensitive credential exposure through excessive environment copying **Risk Level**: Medium ```bash mkdir -p data/env && cp .env data/env/env ``` ### Technical Analysis The Feishu integration requires only `FEISHU_APP_ID` and `FEISHU_APP_SECRET`, but the setup instructions copy the complete `.env` file into `data/env/env`. This can duplicate unrelated credentials, API keys, database passwords, and other secrets into a location intended for the container environment. The command does not explicitly set restrictive permissions on the destination directory or file. The effective permissions depend on the source file, process umask, host configuration, and container volume mappings. Creating an unnecessary second copy also expands the number of locations that must be protected, rotated, excluded from version control, and removed from backups. ### Attack Path 1. A user follows the Skill instructions with an `.env` file containing Feishu credentials and unrelated application secrets. 2. The complete file is copied to `data/env/env`. 3. The data directory is mounted into a container, included in a backup, exposed to another local process, or otherwise granted broader access than the original `.env`. 4. A process or user able to read the duplicated file obtains all credentials stored in the original `.env`, rather than only the two Feishu credentials required by this integration. 5. The exposed credentials may then be used against their corresponding external services. ### Impact Assessment The potential scope is not limited to Feishu. Any secret present in `.env` may be exposed to principals that can access `data/env/env`. Depending on the contents of the host project, this could include credentials for databases, messaging platforms, cloud services, or model providers. This does not independently grant access unless an attac ...[truncated 149 chars]
- Remediation
- ## Remediation Suggestions - Create a dedicated environment file containing only the variables required by this channel. - Create the destination directory and file with restrictive permissions. - Avoid copying unrelated entries from `.env`. - Ensure the generated file is excluded from source control and unnecessary backups. - Document credential rotation and secure deletion requirements. Example hardened approach: ```bash install -d -m 700 data/env umask 077 { printf 'FEISHU_APP_ID=%s\n' "$FEISHU_APP_ID" printf 'FEISHU_APP_SECRET=%s\n' "$FEISHU_APP_SECRET" } > data/env/env chmod 600 data/env/env ``` If values must be read from `.env`, use a parser that selects only the two exact variable names rather than copying the complete file. Prefer the deployment platform's secret-management facility where available.