T09 · Insecure Skill Coding Practices
Error
- Location
scripts/security_audit.py:947- Finding
Shell Credentials Are Copied into Persistent Audit Reports
- Content
View full analysis
50 else m for m in matches[:3]] results.append(AuditResult( category="密钥与凭据安全", name=f"Shell 配置明文密钥: {rc_file.name}", status="fail", severity="high", description=f"发现 {len(matches)} 处明文导出密钥: {'; '.join(sanitized)}", impact=str(rc_file), fix="将密钥移至 .env 文件或密钥管理服务，不在 shell 配置中硬编码", )) ``` ### Technical Analysis The shell-security check reads files such as `.bashrc`, `.zshrc`, `.bash_profile`, and `.profile`, then searches for exported variables whose names suggest that they contain keys, tokens, secrets, or passwords. The code treats truncation to 50 characters as sanitization. This is not effective redaction: - Values shorter than or equal to 50 characters are included in full. - The first 50 characters of longer credentials are disclosed. - Many API keys, passwords, and access tokens are short enough to be exposed completely. - Even a credential prefix can disclose sensitive operational information or be sufficient for abuse in formats where the meaningful secret appears near the beginning. The resulting description is passed to both Markdown and JSON report generators. Reports are saved to disk, and the Markdown report is also printed to standard output unless quiet mode is enabled. The separate Feishu sender can subsequently process and transmit report-derived content, increasing the number of locations through which the data may be exposed. ### Attack Path 1. A legitimate user or attacker-controlled setup places a credential in a shell initialization file, for example as an exported token. 2. The user ...[truncated 1323 chars]- Remediation
View remediation