T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:33- Finding
X Session Credentials Exposed Through Command-Line Arguments
- Content
View full analysis
``` ``` The same insecure command pattern is repeated at `SKILL.md:480-484`. ### Technical Analysis The Skill directs the Agent to interpolate the user's X `auth_token` and `ct0` cookie values directly into a shell command. Command-line arguments are not a secure secret-transfer mechanism. Depending on the operating system and execution environment, they can be exposed through: - Shell history files - Process inspection utilities - Terminal transcripts - Agent execution logs - Endpoint monitoring and audit systems - Error reports that record complete commands The `auth_token` is a reusable session credential. Although the Skill requires the resulting configuration file to have mode `600`, those permissions do not protect credentials while they are present in process arguments or retained in shell and Agent logs. ### Attack Path 1. The user obtains `auth_token` and `ct0` from Chrome. 2. The Agent substitutes both credentials into the documented `update-cookies` command. 3. The shell, Agent runtime, process monitor, or audit system records or exposes the complete command. 4. A local user, malicious process, log reader, or compromised monitoring component retrieves the cookie values. 5. The attacker reuses the captured session credentials to make authenticated requests to X, subject to X's session validation and other account controls. ### Impact Assessment Successful exploitation can disclose the user's active X session credentials. An attacker may be able to impersonate the authenticated session and access account data or perform actions allowed ...[truncated 310 chars]- Remediation
View remediation