T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:52- Finding
Reusable COROS Credential Exposed Through Weak Storage and Logging Guidance
- Content
View full analysis
{ const hashedPassword = createHash("md5").update(password).digest("hex"); return hashedPassword; }; ``` `SKILL.md:52-58`: ```js import { genHashedPassword } from "./util.js"; const hashedPassword = genHashedPassword("your_plain_password"); console.log(hashedPassword); // Output the MD5-hashed password for COROS_PASSWORD ``` `scripts/.env:1-3`: ```env # COROS account configuration COROS_ACCOUNT=xxx COROS_PASSWORD=xxx ``` `scripts/coros.js:42-49`: ```js const response = await axios.post( COROS_URLS.LOGIN_URL, { account: this.account, accountType: 2, pwd: this.password, }, { headers: DEFAULT_HEADERS, timeout: 60000 }, ); ``` ### Technical Analysis The generated MD5 value is transmitted directly as the `pwd` login parameter. It therefore functions as a reusable password-equivalent credential rather than merely as a non-reversible password-verification record. MD5 is a fast, unsalted hash and is unsuitable for protecting passwords. More importantly, because the COROS endpoint accepts the hash itself for authentication, an attacker may not need to recover the original plaintext password: possession of the hash may be sufficient for replay. The documentation recommends storing this credential in a project-local `.env` file and demonstrates printing it to standard output. This can expose the credential through: - Accidental source-control commits. - Terminal scrollback and shell-session capture. - CI/CD logs. - Process output collected by monitoring systems. - Backups or copies of the project directory. - Excessively permissive local file permissions. The checked-in `.env` contains ...[truncated 1454 chars]- Remediation
View remediation