T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:106- Finding
Plaintext MySQL Password Exposed Through Script and Command-Line Arguments
- Content
View full analysis
${BACKUP_DIR}/${DATE}/${DATABASE}.sql.gz ``` ### Technical Analysis The backup template stores a MySQL password directly in a shell variable and then supplies it to `mysqldump` through the `-p` command-line option. Although `"password"` is presented as an example placeholder, users who adopt the template are encouraged to replace it with a real credential while retaining the insecure storage and invocation pattern. A real password embedded in this script may be disclosed through: - Read access to the script or copies of it in source control and backup systems. - Process inspection while `mysqldump` is running, depending on the operating system and process visibility controls. - Debugging output, command tracing such as `set -x`, monitoring agents, or diagnostic collection. - Accidental inclusion of the script in logs, support bundles, or shared configuration archives. The use of a dedicated `backup` username limits exposure only if that account is properly restricted. The example does not document or enforce least-privilege permissions. ### Attack Path 1. An administrator copies the documented backup script into an operational environment. 2. The placeholder value assigned to `MYSQL_PASS` is replaced with a valid database password. 3. The resulting script is stored on disk, committed to a repository, collected in a backup, or executed with the password present in its command-line arguments. 4. A local user, repository reader, monitoring service, or other actor with access to one of these disclosure channels ...[truncated 940 chars]- Remediation
View remediation
"${BACKUP_DIR}/${DATE}/${DATABASE}.sql.gz" ``` 3. Prefer `mysql_config_editor` or an approved secrets manager when supported. Retrieve secrets at runtime without printing them or persisting them in source-controlled files. 4. Run the backup under a dedicated operating-system identity and a dedicated MySQL account. 5. Grant the MySQL account only the permissions required to perform the intended backup. Restrict its accessible schemas, source hosts, and network paths. 6. Prevent shell tracing around secret retrieval and ensure logs, monitoring tools, and error handlers do not capture credentials. 7. Rotate any production password previously embedded in a copied version of this template and inspect source-control history, backup archives, and logs for prior exposure. 8. Quote path and database variable expansions in the final script to reduce unrelated shell-expansion risks. ]]>