T09 · Insecure Skill Coding Practices
Error
- Location
- references/cli-examples.md:15
- Finding
- Plaintext Secret Disclosure Through Disabled Output Masking## Vulnerability Details **File Location**: `references/cli-examples.md`, lines 15–17 **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: High ### Vulnerable Code ```markdown ## Run - `export DB_PASSWORD="op://app-prod/db/password"` - `op run --no-masking -- printenv DB_PASSWORD` - `op run --env-file="./.env" -- printenv DB_PASSWORD` ``` ### Technical Analysis The example resolves a 1Password secret into the `DB_PASSWORD` environment variable and then executes `printenv DB_PASSWORD`. The `--no-masking` option explicitly disables 1Password CLI output masking, causing the resolved database password to be emitted in plaintext. This practice conflicts with the guardrail in `SKILL.md` that prohibits placing secrets in logs, chat, or code. Terminal output can be retained in tmux pane history, agent tool results, shell transcripts, CI/CD logs, session recordings, monitoring systems, or copied into conversational context. The adjacent `--env-file` example also prints the resolved value, although default masking may reduce exposure; secret-consuming commands should never be demonstrated using output utilities such as `printenv`. ### Attack Path 1. An operator or AI agent follows the documented `op run` example. 2. The authenticated 1Password CLI retrieves the secret referenced by `op://app-prod/db/password`. 3. `op run` places the resolved password in the child process environment as `DB_PASSWORD`. 4. The `--no-masking` option disables 1Password's normal output redaction. 5. `printenv DB_PASSWORD` writes the plaintext password to standard output. 6. The output may be captured in tmux scrollback, agent tool output, logs, session recordings, or chat history. 7. Anyone with access to those retained outputs can reuse the disclosed credential against the corresponding database until it is rotated or revoked. ### Impact Assessment Successful exploitation discloses the selected database credential to ...[truncated 458 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `--no-masking -- printenv DB_PASSWORD` example and avoid all examples that print resolved secrets. 2. Demonstrate `op run` with an application that consumes the credential without displaying it, for example: ```bash export DB_PASSWORD="op://app-prod/db/password" op run -- database-client --execute-safe-operation ``` 3. Retain 1Password's default output masking and explicitly prohibit `--no-masking` whenever command output could contain secrets. 4. Add a warning that `printenv`, `env`, shell tracing (`set -x`), debug logging, and verbose application modes must not be used with resolved secret values. 5. Ensure tmux pane captures and agent responses are reviewed to prevent secret-bearing output from entering logs or chat. 6. If the documented command has already been executed, remove accessible transcripts where feasible, rotate the affected database credential, and review database access logs for unauthorized use.