T09 · Insecure Skill Coding Practices
- Location
scripts/csdn_article.js:67- Finding
Reusable CSDN Authentication Credentials Stored in Plaintext
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:27-65,config/config_example.json:1-8, andscripts/csdn_article.js:67-75
Vulnerability Type: Plaintext storage of sensitive authentication material
Risk Level: MediumThe documented workflow directs users to store a CSDN session cookie, API key, nonce, and request signature in a plaintext
csdn_config.jsonfile. The application then reads this file without checking or enforcing restrictive file permissions.Relevant configuration structure from
config/config_example.json:1-8:json { "headers": { "Cookie": "your_cookie_here", "x-ca-nonce": "xxxxxx", "x-ca-signature": "xxxxxxxx", "x-ca-signature-headers": "x-ca-key,x-ca-nonce", "x-ca-key": "xxxxxxxx" } }Configuration loading logic from
scripts/csdn_article.js:67-75:javascript function loadConfig(configPath) { const resolvedPath = path.resolve(configPath); if (!fs.existsSync(resolvedPath)) { log.error(`Config file '${resolvedPath}' not found`); process.exit(1); } return JSON.parse(fs.readFileSync(resolvedPath, 'utf-8')); }Technical Analysis
The
Cookie,x-ca-key, and signature-related headers are authentication material that may authorize operations against the user's CSDN account. Storing these values in an ordinary plaintext file exposes them to any process or local user that can read the file.The implementation does not:
- Validate that the configuration file is owned by the current user.
- Reject group-readable or world-readable permissions.
- Create the file with a restrictive mode such as
0600. - Support an operating-system credential store.
- Provide a repository-level ignore rule for
csdn_config.json. - Warn when the credential file is located inside a version-controlled directory.
Although the repository only contains placeholders and does not contain leaked production credentials, the ...[truncated 1601 chars]
- Remediation
View remediation
Remediation Suggestions
-
Avoid plaintext credential files where possible
- Read sensitive values from environment variables.
- Prefer an operating-system credential manager or encrypted secret store.
- Keep only non-sensitive defaults in the JSON configuration file.
-
Enforce restrictive permissions
- On POSIX systems, inspect the file mode before reading it and reject files accessible by group or other users.
- Require a mode equivalent to
0600. - Verify that the credential file is owned by the current user.
-
Prevent accidental source-control disclosure
- Add
csdn_config.jsonand equivalent credential filenames to.gitignore. - Provide a separate placeholder file such as
csdn_config.example.json. - Detect whether the selected credential file is tracked by Git and display a blocking error or prominent warning.
- Add
-
Minimize credential lifetime and exposure
- Recommend using short-lived session material.
- Avoid printing authentication headers in logs or error messages.
- Document immediate cookie and API credential rotation after suspected disclosure.
-
Separate secrets from ordinary settings
- Keep publishing defaults in the JSON file.
- Load
Cookie,x-ca-key,x-ca-nonce, andx-ca-signaturefrom protected secret sources at runtime.
-
Harden file handling
- Resolve symbolic links and reject credential files that point to unexpected or shared locations.
- If the application creates a credential file in future versions, use an atomic creation operation with exclusive access and mode
0600.
-