T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:24
- Finding
- Wi-Fi Password Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 24–31 **Vulnerability Type**: Plaintext sensitive data exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```bash # Generate a QR code for a Wi-Fi network (defaults to WPA) wifi-qr "MyNetwork" "mypassword" # Specify the security type explicitly wifi-qr "MyNetwork" "mypassword" --type WPA ``` ### Technical Analysis The documented interface instructs users to supply a plaintext Wi-Fi password as a command-line argument. When a real credential is substituted for `"mypassword"`, it may be stored in shell history and terminal or session logs. While the command is running, the credential may also be exposed through operating-system process inspection facilities. This handling pattern unnecessarily places sensitive authentication material in locations that are commonly retained or observable. Exploitation does not require control of the skill itself, but it generally requires local access, access to collected logs, or permission to inspect the affected user's processes or command history. ### Attack Path 1. A user follows the documented example and replaces `"mypassword"` with a real Wi-Fi password. 2. The shell records the complete command in its history, or a terminal, session recorder, monitoring agent, or support tool captures it. 3. During execution, the password may additionally appear in the process argument list. 4. An attacker with suitable local or log-reading access retrieves the exposed command. 5. The attacker extracts the Wi-Fi password and uses it to authenticate to the corresponding wireless network. ### Impact Assessment Successful exploitation discloses the Wi-Fi pre-shared key supplied by the user. The attacker may gain the same network access granted to devices using that credential, subject to network segmentation and other controls. This could enable unauthorized use of network resources, ac ...[truncated 347 chars]
- Remediation
- ## Remediation Suggestions - Redesign the `wifi-qr` interface to read the Wi-Fi password interactively from a non-echoing terminal prompt rather than from a positional command-line argument. - Alternatively, accept the secret through protected standard input or a permission-restricted credential file, ensuring that it is not logged. - Avoid environment variables for long-lived secret handling because they may also be exposed through process inspection, diagnostics, or crash reports. - Update the documentation so examples do not encourage users to place real credentials directly in commands. - Ensure the implementation does not print the password, include it in errors, or persist it in temporary files. - If temporary storage is unavoidable, create files with restrictive permissions, avoid predictable paths, and securely remove them immediately after QR-code generation. - Advise users who followed the existing documentation to remove affected shell-history entries and rotate Wi-Fi credentials if command histories or logs may have been exposed.