T09 · Insecure Skill Coding Practices
- Location
scripts/notify.py:34- Finding
Sensitive credentials exposed through command-line arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/notify.py:34-38, 236-240
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: MediumVulnerable Code
python CRED_FLAGS = [ ("url", "url"), ("secret", "secret"), ("token", "token"), ("chat-id", "chat_id"), ("smtp-host", "smtp_host"), ("port", "port"), ("user", "user"), ("password", "password"), ("to", "to"), ("sender", "sender"), ]python a.add_argument("channel", help="通道名（feishu/wecom/dingtalk/slack/telegram/email）") a.add_argument("target", help="目标名（如群名/收件人）") for flag, dest in CRED_FLAGS: a.add_argument(f"--{flag}", dest=dest, default=None)The documented usage also encourages literal credentials in command lines:
bash notify config add feishu 我的群 \ --url https://open.feishu.cn/open-apis/bot/v2/hook/xxx \ --secret xxxTechnical Analysis
The CLI accepts webhook URLs, bot tokens, signing secrets, and SMTP passwords as ordinary command-line options. Command-line arguments are not an appropriate secret-ingestion mechanism because they can be retained in shell history, terminal session logs, command auditing systems, and automation logs. Depending on the host configuration, process arguments may also be observable by other local processes while the command is running.
The application subsequently restricts the saved configuration file to mode
0600, which is a useful control for credentials at rest. However, that permission does not protect credentials before storage when they are present in the command line.Webhook URLs are also credentials in this context: Feishu, WeCom, DingTalk, and Slack webhook URLs contain tokens that authorize message submission. Exposure therefore affects more than the explicitly named
--secret,--token, and--passwordoptions.Attack Path
- A user follows the documented configuration workflow an ...[truncated 1722 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove sensitive values from ordinary CLI options. Prompt interactively with
getpass.getpass()for passwords, tokens, and signing secrets. - Support a protected configuration file or secret-manager integration. Where automation is required, accept secrets through restricted file descriptors or files with verified ownership and
0600permissions. - If environment-variable support is added, document that environment variables may also be exposed by process diagnostics and should only be used where the runtime protects them.
- Treat webhook URLs as secrets because authentication tokens are embedded in them. Provide secure interactive input for
--url, or support a protected input file. - Retain the existing
0600permission on the saved configuration, but create the file atomically with restrictive permissions rather than writing it under the process umask and applyingchmodafterward. - Update
SKILL.md,README.md, and other examples so they do not encourage literal secrets on command lines. - Add tests confirming that secret prompts do not echo input and that status messages never print credentials.
- Advise existing users to remove credential-bearing commands from shell history and rotate any credentials previously supplied this way.
- Remove sensitive values from ordinary CLI options. Prompt interactively with