T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:14
- Finding
- Bitwarden Session Secret Persisted in a Shell Startup File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14 and 51 **Vulnerability Type**: Plaintext persistence of a sensitive authentication session **Risk Level**: High ### Vulnerable Code ```markdown - `BW_SESSION` env var set (saved in `~/.zshrc`) ``` ```markdown - Session key is in `BW_SESSION` env var (persisted in ~/.zshrc) ``` ### Technical Analysis The documentation directs users to persist `BW_SESSION` in `~/.zshrc`. This variable contains a sensitive Bitwarden vault session key produced after the vault is unlocked. Storing it in a shell startup file leaves the secret in plaintext on disk and automatically exports it into subsequently created shell environments. Any process or user capable of reading the startup file or inspecting an inheriting process environment could obtain the session key. While it remains valid, the key may be supplied to the official `bw` CLI to access decrypted vault content without repeating the normal interactive authentication or unlock process. The project does not contain evidence of an automated exfiltration mechanism. Exploitation therefore requires an attacker to have access to the affected user's files, process environment, terminal logs, backups, or another location where the startup file is copied. ### Attack Path 1. A user follows the Skill documentation and saves a valid `BW_SESSION` value in `~/.zshrc`. 2. An attacker, malicious local process, compromised development tool, or unintended backup obtains read access to that file or to the environment of a descendant shell process. 3. The attacker extracts the plaintext session key. 4. The attacker assigns the stolen value to `BW_SESSION` in another process. 5. Before the session expires or is invalidated, the attacker invokes commands such as: - `bw get password "item"` - `bw get item "item"` - `bw get totp "item"` - `bw list items` 6. The Bitwarden CLI accepts the active session and returns vault information available to the comp ...[truncated 662 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all instructions recommending that `BW_SESSION` be saved in `~/.zshrc`, `.bashrc`, shell profiles, dotfiles, or other persistent plaintext files. 2. Generate the session only when needed, for example: ```bash export BW_SESSION="$(bw unlock --raw)" ``` 3. Keep the session in a short-lived, dedicated shell and avoid passing it to unrelated child processes. 4. Clear the environment variable immediately after completing vault operations: ```bash unset BW_SESSION ``` 5. Lock the vault after use: ```bash bw lock ``` 6. Avoid printing, logging, copying, or recording the session key in command histories, CI logs, terminal transcripts, or debugging output. 7. Restrict permissions on any files that may previously have contained the key and inspect shell history, dotfile repositories, backups, and synchronization services for leaked copies. 8. Invalidate any session that was previously persisted, then authenticate again to establish a fresh short-lived session. 9. Update the documentation to explain that `BW_SESSION` is a bearer-style sensitive secret and must be handled with the same care as vault credentials. ]]>