T09 · Insecure Skill Coding Practices
- Location
agents/fb_token_helper.py:99- Finding
Facebook Access Tokens Are Printed and Persisted in Plaintext
- Content
View full analysis
Vulnerability Details
File Location:
agents/fb_token_helper.py, lines 99 and 127-138
Vulnerability Type: Plaintext disclosure and insecure storage of authentication credentials
Risk Level: HighVulnerable Code
python long_token = exchange_to_long_lived(short_token) console.print(f"[green]✅ Long-lived User Token:[/green]\n{long_token}\n")python # Save to .env hint console.print("\n[bold green]✅ XONG! Cập nhật .env:[/bold green]") for page in pages: console.print(f"\nPage: [bold]{page.get('name')}[/bold] (ID: {page.get('id')})") console.print(f"FB_USER_ACCESS_TOKEN={long_token}") console.print(f"FB_PAGE_ACCESS_TOKEN={page.get('access_token')}") console.print(f"FB_PAGE_ID={page.get('id')}") # Save to file output_path = "fb_tokens_output.json" with open(output_path, "w", encoding="utf-8") as f: json.dump({ "long_lived_user_token": long_token, "pages": pages }, f, ensure_ascii=False, indent=2) console.print(f"\n[dim]Token đã lưu vào {output_path} (đừng commit file này!)[/dim]")Technical Analysis
The helper prints the complete long-lived user token and every Page access token to the terminal. It also stores those credentials in
fb_tokens_output.jsonas unencrypted JSON using the process's default file permissions.Access tokens are bearer credentials: possession of a token is generally sufficient to exercise its authorized Facebook Graph API capabilities. Printing them exposes the credentials to terminal history, session recording, CI logs, remote-support tooling, and centralized log collection. Persisting them in a predictable plaintext file additionally exposes them through shared workspaces, backups, artifacts, and accidental source-control commits.
The code does not explicitly create the output file with owner-only permissions. The reviewed project structure also contains no
.gitignorethat protects `fb_tokens_outpu ...[truncated 1625 chars]- Remediation
View remediation
Remediation Suggestions
- Remove all output that prints complete user or Page access tokens.
- If token identification is necessary, display only a masked value, such as the final four characters.
- Do not persist tokens by default. Require explicit user consent before writing any credential to disk.
- Prefer an operating-system credential store, dedicated secrets manager, or protected environment-variable configuration.
- If file storage is unavoidable:
- Create the file atomically with owner-only permissions such as
0600. - Use a user-selected secure location rather than a predictable project-root filename.
- Avoid retaining tokens longer than operationally required.
- Add
fb_tokens_output.jsonand other secret-bearing files to.gitignore.
- Create the file atomically with owner-only permissions such as
- Warn users that terminal output may be recorded by CI systems, shell logging, or remote administration tools.
- Revoke and rotate any token that has already appeared in logs, artifacts, repositories, or shared files.
- Add automated secret scanning and a regression test that verifies complete tokens are never emitted to console output.