T09 · Insecure Skill Coding Practices
Error
- Location
scripts/connect_mercury.mjs:5- Finding
API Credentials Exposed Through Command-Line Arguments and Plaintext SQLite Storage
- Content
View full analysis
[entity_name]'); process.exit(1); } ``` `scripts/connect_mercury.mjs:31-32`: ```js // Create connection (store token as-is locally — no encryption needed for local SQLite) const connResult = db.prepare('INSERT INTO connections (entity_id, provider, access_token) VALUES (?, ?, ?) RETURNING id').get(entityId, 'mercury', token); ``` `scripts/connect_stripe.mjs:5-10`: ```js const entityId = process.argv[2]; const apiKey = process.argv[3]; if (!entityId || !apiKey) { console.error('Usage: connect_stripe.mjs '); process.exit(1); } ``` `scripts/connect_stripe.mjs:28-36`: ```js const existing = db.prepare('SELECT id FROM connections WHERE entity_id = ? AND provider = ?').get(Number(entityId), 'stripe'); let connectionId; if (existing) { db.prepare('UPDATE connections SET access_token = ?, updated_at = datetime(\'now\') WHERE id = ?').run(apiKey, existing.id); connectionId = existing.id; console.log(` Updated existing Stripe connection (id: ${connectionId})`); } else { const result = db.prepare('INSERT INTO connections (entity_id, provider, access_token) VALUES (?, ?, ?) RETURNING id').get(Number(entityId), 'stripe', apiKey); ``` `scripts/lib/db.js:7-8, 13-15`: ```js const DATA_DIR = join(SKILL_DIR, 'data'); const DB_PATH = join(DATA_DIR, 'heath.db'); let _db = null; export function getDb() { if (_db) return _db; mkdirSync(DATA_DIR, { recursive: true }); _db = new Database(DB_PATH); ``` `scripts/l ...[truncated 3159 chars]- Remediation
View remediation