T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/login.py:93- Finding
Reusable account credentials are stored in plaintext inside the project directory
- Content
View full analysis
tuple: """ 从 assets/credentials.json 加载账号密码 Returns: (email, password) 元组 """ credentials_file = os.path.join(os.path.dirname(__file__), '..', 'assets', 'credentials.json') if not os.path.exists(credentials_file): raise FileNotFoundError(f"找不到账号配置文件: {credentials_file}，请先创建并填入 email 和 password") with open(credentials_file, 'r', encoding='utf-8') as f: data = json.load(f) email = data.get('email', '').strip() password = data.get('password', '').strip() if not email or not password: raise ValueError("assets/credentials.json 中 email 或 password 为空，请填写") return email, password ``` The documented configuration in `SKILL.md:59-69` instructs users to populate the file as follows: ```json { "email": "your@email.com", "password": "your_password" } ``` ### Technical Analysis The Skill stores a reusable LetPub email address and password in an unencrypted JSON file under `assets/`. The implementation does not use an operating-system credential store, encrypted secret storage, or restrictive file-permission enforcement. Because the secret is located inside the project tree, it can also be included inadvertently in source-control commits, archives, backups, diagnostic bundles, or Skill redistribution. Sending the credentials to LetPub's declared HTTPS login endpoint is necessary for authenticated comment retrieval and is not, by itself, unauthorized exfiltration. The vulnerability is the persistent plaintext storage model rather than the first-party HTTPS login operation. ### Attack Path 1. A user follows `SKILL.md` and writes a valid LetPub email address and password into `assets/credentials.json`. 2. The plaintext file remains in the project directory after authentication. 3. Anot ...[truncated 911 chars]- Remediation
View remediation