T09 · Insecure Skill Coding Practices
Warning
- Location
- config.toml:3
- Finding
- Mailbox Credentials Stored in Plaintext Configuration<![CDATA[ ## Vulnerability Details **File Location**: `config.toml:3-15`, `main.py:45-72`, `SKILL.md:27-38`, `README.md:19-29` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium ### Vulnerable Code `config.toml:3-15`: ```toml [email] # POP3 server (for receiving emails) server = "pop.chinatelecom.cn" port = 995 username = "zhanggh5@chinatelecom.cn" password = "填写密码" [smtp] # SMTP server (for sending emails) server = "smtp.chinatelecom.cn" port = 465 username = "zhanggh5@chinatelecom.cn" password = "填写密码" ``` `main.py:45-72`: ```python DEFAULT_CONFIG = { 'pop_server': 'pop.chinatelecom.cn', 'pop_port': 995, 'pop_user': 'zhanggh5@chinatelecom.cn', 'pop_pass': '填写密码', 'smtp_server': 'smtp.chinatelecom.cn', 'smtp_port': 465, 'smtp_user': 'zhanggh5@chinatelecom.cn', 'smtp_pass': '填写密码', } def load_config(): """Load configuration from config.toml.""" config = DEFAULT_CONFIG.copy() config_path = os.path.join(os.path.dirname(__file__), 'config.toml') if os.path.exists(config_path): with open(config_path, 'rb') as f: toml_config = tomllib.load(f) if 'email' in toml_config: config['pop_server'] = toml_config['email'].get('server', config['pop_server']) config['pop_port'] = toml_config['email'].get('port', config['pop_port']) config['pop_user'] = toml_config['email'].get('username', config['pop_user']) config['pop_pass'] = toml_config['email'].get('password', config['pop_pass']) if 'smtp' in toml_config: config['smtp_server'] = toml_config['smtp'].get('server', config['smtp_server']) config['smtp_port'] = toml_config['smtp'].get('port', config['smtp_port']) config['smtp_user'] = toml_config['smtp'].get('username', config['smtp_user']) config['smtp_pass'] = toml_config['smtp'].get('password', config['smtp_pas ...[truncated 2387 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove account-specific identifiers and all password fields from committed configuration files. Ship only a sanitized `config.toml.example`. 2. Read secrets from a protected secret manager, operating-system credential store, or environment variables. Keep non-sensitive server settings separate from credentials. 3. Add actual environment-variable support, for example for `CHINATELECOM_POP_USER`, `CHINATELECOM_POP_PASSWORD`, `CHINATELECOM_SMTP_USER`, and `CHINATELECOM_SMTP_PASSWORD`. 4. Refuse to start when credentials are missing rather than retaining account-specific or placeholder defaults. 5. On POSIX systems, verify that any fallback credential file is owned by the current user and has permissions no broader than `0600`. Reject insecure permissions with a clear error. 6. Add `config.toml` to `.gitignore` and provide pre-commit or secret-scanning checks to prevent accidental credential commits. 7. Prefer provider-issued, narrowly scoped authorization codes over the mailbox's primary password, and document credential rotation and revocation procedures. 8. If the exposed mailbox identifier is not intended to be public, remove it from source history and review whether any associated credentials need rotation. ]]>