T09 · Insecure Skill Coding Practices
Warning
- Location
blog-mini-kit-ljt2.py:493- Finding
User Password Exposure Through Command-Line Arguments and Unencrypted HTTP
- Content
View full analysis
").strip().rstrip('/') if not base_url: print("错误：API 地址不能为空", file=sys.stderr) sys.exit(3) if not (base_url.startswith("http://") or base_url.startswith("https://")): print("错误：地址必须以 http:// 或 https:// 开头", file=sys.stderr) sys.exit(3) print("提示：可通过 export %s_BASE_URL=\"%s\" 永久设置，避免每次输入。" % (_CRED_PREFIX, base_url)) ``` `blog-mini-kit-ljt2.py:251-256` places the supplied password directly into the request body: ```python payload = {'uname': args.uname} if args.phone is not None: payload['phone'] = args.phone if args.pwd is not None: payload['pwd'] = args.pwd if args.email is not None: ``` `blog-mini-kit-ljt2.py:490-494` accepts that password as a command-line argument: ```python p_cu = sub.add_parser('create-user', help='创建用户') p_cu.add_argument('--uname', required=True, help='用户名（必填）') p_cu.add_argument('--phone', default=None, help='手机号') p_cu.add_argument('--pwd', default=None, help='密码') p_cu.add_argument('--email', default=None, help='邮箱') ``` The documented invocation in `SKILL.md:295` also encourages direct command-line password entry: ```bash python3 scripts/blog-mini-kit-ljt2.py create-user --uname "用户名" [--phone TXT] [--pwd TXT] [--email TXT] [--img TXT] ``` The configuration guidance explicitly presents HTTP URLs in `SKILL.md:41,55,65`, including: ```bash export BLOG_MINI_KIT_LJT2_BASE_URL="http://:" # (示例) ``` ### Technical Analysis Passwords passed through `--pwd` can be retained in shell history and may be visible in process listings, audit logs, terminal recording systems, job-runner metadata, and monitoring tools. On multi-user syst ...[truncated 1951 chars]- Remediation
View remediation