T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_auth_token.py:34- Finding
Reusable Basic Authentication Credential Exposed Through Command-Line Arguments and Standard Output
- Content
View full analysis
") sys.exit(1) app_key = sys.argv[1] app_secret = sys.argv[2] token = generate_access_token(app_key, app_secret) print(f"Access Token: {token}") print(f"\nUse in Authorization header as: Basic {token}") ``` The token-generation operation at `scripts/generate_auth_token.py:27-29` is: ```python credentials = f"{app_key}:{app_secret}" access_token = base64.b64encode(credentials.encode()).decode() return access_token ``` The insecure invocation is also recommended in `SKILL.md:59-63`: ```bash python scripts/generate_auth_token.py YOUR_APP_KEY YOUR_APP_SECRET ``` ### Technical Analysis The helper accepts the application secret as a command-line argument and then prints a reusable Basic authentication credential to standard output. Command-line secrets can be exposed through shell history, process inspection facilities, execution telemetry, CI logs, terminal recordings, and Agent tool-call transcripts. The output introduces another disclosure channel because standard output may be captured by terminals, automation systems, logs, or an Agent and returned to its caller. Base64 provides no confidentiality. The printed value can be decoded directly to recover the original `app_key:app_secret` pair. Consequently, printing the token is effectively equivalent to printing the application secret. This behavior is not necessary for the Skill's declared video-generation functionality. The main client can construct the Authorization header internally and transmit it directly to the fixed HTTPS API endpoint without revealing the credential to the user or Agent output. The hel ...[truncated 1803 chars]- Remediation
View remediation