T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/get_result.sh:3- Finding
Credential Exposed Through Command-Line Arguments
- Content
View full analysis
ORDER_NO="${1:?Usage: ./get_result.sh }" CREDENTIAL="${2:?Missing credential}" ``` ### Technical Analysis The result-retrieval credential is accepted as the second positional command-line argument. Secrets passed this way may be exposed through: - Shell command history. - Process-monitoring tools while the script is running. - Operating-system process metadata, depending on local access controls. - Terminal session recording, audit logging, or automation logs. - Wrapper scripts and CI/CD systems that log complete commands. The README also instructs users to supply the credential directly on the command line, making exposure part of the documented workflow rather than an exceptional use case. ### Attack Path 1. A user invokes `get_result.sh` with a valid credential as the second argument. 2. The shell records the command in its history, or the running command becomes visible in process metadata. 3. Another local account, monitoring component, compromised process, or log reader obtains the credential. 4. The attacker submits the captured credential and associated order information to the result API. 5. If the server does not bind the credential sufficiently to the original user or enforce single use, the attacker can retrieve the paid result or impersonate the credential holder. ### Impact Assessment An attacker may gain unauthorized access to paid analysis results and any sensitive request content returned with them. Exposure is limited to the credential's server-side permissions; this flaw does not directly grant operating-system privileges or establish persistence. The practical scope depends on whether credentials are ...[truncated 81 chars]- Remediation
View remediation