T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_auth_token.py:27- Finding
Reusable API Credentials Exposed Through Command-Line Arguments and Standard Output
- Content
View full analysis
") sys.exit(1) app_key = sys.argv[1] app_secret = sys.argv[2] token = generate_access_token(app_key, app_secret) print(f"Access Token: {token}") print(f"\nUse in Authorization header as: Basic {token}") ``` The documented invocation in `SKILL.md:43` is: ```bash python scripts/generate_auth_token.py YOUR_APP_KEY YOUR_APP_SECRET ``` The main client has the same command-line secret exposure pattern at `scripts/tomoviee_img2video_client.py:143-148`: ```python print( "Usage: python scripts/tomoviee_img2video_client.py " " [resolution] [aspect_ratio]" ) sys.exit(1) app_key = sys.argv[1] app_secret = sys.argv[2] ``` ### Technical Analysis Base64 is reversible encoding rather than encryption. The generated token contains the application key and secret in the form `base64(app_key:app_secret)`. Any party able to read the helper's stdout can decode the value and recover both credentials. The helper also requires the secret as a command-line argument. Depending on the execution environment, command-line arguments may be exposed through: - Shell history - Process listings and process inspection interfaces - Job-runner or orchestration metadata - Debug and audit logs - Agent execution transcripts Printing the complete Basic authorization value is unnecessary for the Skill's declared image-to-video oper ...[truncated 1608 chars]- Remediation
View remediation
` from the command-line interface in both scripts. - Document supported secure credential-loading methods and warn that Base64 does not protect secrets. 5. **Apply operational controls** - Rotate any credentials previously used with the helper in logged or Agent-mediated environments. - Restrict access to historical process, CI, orchestration, and Agent logs. - Redact authorization headers and known credential fields at logging boundaries. ]]>