T09 · Insecure Skill Coding Practices
Error
- Location
scripts/security-audit.sh:248- Finding
Secret Detection Results Can Expose Credentials in Terminal and CI Logs
- Content
View full analysis
/dev/null | grep -v "node_modules\|.git\|test\|spec\|example\|placeholder\|your_\|YOUR_\|xxxx\|XXXX" | head -5) if [ -n "$matches" ]; then error "Found potential $name" if [ "$VERBOSE" = true ]; then echo "$matches" | head -3 fi ``` The CI templates similarly invoke `grep` without suppressing matched lines: ```yaml - name: Secret Detection run: | # AWS Access Keys ! grep -rn 'AKIA[0-9A-Z]\{16\}' --include='*.{js,ts,py,env,yml,yaml}' . # OpenAI API Keys ! grep -rn 'sk-[A-Za-z0-9]\{20,\}' --include='*.{js,ts,py,env}' . # GitHub Tokens ! grep -rn 'ghp_[A-Za-z0-9]\{36\}\|github_pat_' --include='*.*' . # Private Keys ! grep -rn 'BEGIN.*PRIVATE KEY' --include='*.*' . continue-on-error: true ``` ### Technical Analysis The scanner stores complete matching source lines in `matches` and prints up to three of those lines when verbose mode is enabled. Because secret assignments commonly place the credential and variable name on the same line, this output can disclose the complete credential. The CI checks also use ordinary recursive `grep`, which prints matching file names, line numbers, and line contents. Negating the exit status with `!` changes only success or failure; it does not suppress output. Consequently, detected secrets may be copied from source files into CI logs. CI logs can have different retention policies and broader access than repositor ...[truncated 1313 chars]- Remediation
View remediation