T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/hot_scanner.py:22- Finding
Entire Process Environment Exposed to the External Bird CLI
- Content
View full analysis
- Remediation
View remediation
dict[str, str]: allowed = {"AUTH_TOKEN", "CT0"} credentials = {} if path.exists(): for raw_line in path.read_text().splitlines(): line = raw_line.strip() if not line or line.startswith("#") or "=" not in line: continue key, value = line.split("=", 1) key = key.strip() if key in allowed: credentials[key] = value.strip().strip('"').strip("'") return credentials ``` 3. Construct a minimal subprocess environment instead of copying the parent environment: ```python credentials = load_bird_credentials(ENV_FILE) env = { "PATH": os.environ.get("PATH", ""), "LANG": os.environ.get("LANG", "C.UTF-8"), **credentials, } ``` 4. Refuse to invoke Bird when either required credential is absent instead of inheriting arbitrary fallback values. 5. Resolve Bird to a trusted, fixed path and verify that it is a regular file with expected ownership and permissions. 6. Run the social scanner in an isolated process or container without unrelated Agent credentials. 7. Apply the same remediation to both Twitter search functions in `rumor_scanner.py` and to `HotScanner.scan_twitter()`. 8. Keep the `.env` file outside the project source tree where practical, restrict it to owner-only permissions, and document that it must not be committed to version control. ]]>