fix(security): env vars with mid-name API/KEY/TOKEN no longer flag as exfiltration (salvage #63994) - #98322
Merged
Conversation
Anchor env var name matches with \b to avoid matching legitimate env vars that contain KEY/TOKEN/API as substrings (e.g., $TRILLIUM_ETAPI_URL). The patterns now require KEY/TOKEN/SECRET/PASSWORD to appear at the END of the env var name, reducing false positives on common API-usage documentation in SOUL.md while still catching actual exfiltration attempts. Fixes #63977
…rd sibling patterns Same bug class as the salvaged terminal-scanner fix: skills_guard's env_exfil_curl/wget/fetch used unanchored \w*(KEY|TOKEN|...|API) alternations, so any var with API/KEY/TOKEN mid-name ($TRILLIUM_ETAPI_URL) scored a critical exfiltration finding. Applied the same \b anchor + plural tolerance, dropped mid-name API (every real secret it caught already ends in KEY/TOKEN), kept CREDENTIAL, and kept the loopback exemption from #98246. httpx/requests patterns unchanged — their (KEY|TOKEN|...) alternation is unanchored-by-design against argument text, not var-name suffixes.
Contributor
૮ >ﻌ< ა ci reviewran on 3a116d1 — fix(security): widen the exfil substring-suffix fix to the s
|
alt-glitch
added
type/bug
23 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix(security): env vars with mid-name API/KEY/TOKEN no longer flag as exfiltration (salvage #63994)
Summary
Benign env vars whose names merely contain a secret-suffix substring (
$TRILLIUM_ETAPI_URL,$MY_ETAPI_URL) no longer score exfiltration findings. Salvage of @liuhao1024's #63994 (terminal threat scanner, #63977) plus the same-class fix widened to the sibling patterns in the skills-hub install scanner.Changes
tools/threat_patterns.py:exfil_curl/exfil_wgetanchor the var-name suffix with\band tolerate plurals; mid-nameAPIdropped from the alternation (every real secret it caught —$OPENAI_API_KEY— already ends in KEY/TOKEN). Regression tests included.tools/skills_guard.py:env_exfil_curl/env_exfil_wget/env_exfil_fetchhad the identical unanchored\w*(KEY|TOKEN|...|API)shape, so any skill mentioning$SOMETHING_ETAPI_URLin a script scored a critical finding (community-blocking). Same anchor + plural fix,CREDENTIALkept, loopback exemption from feat(skills-hub): impeccable joins the optional-skills catalog, content pulled live from upstream #98246 kept.env_exfil_httpx/requestsuntouched — their alternation matches argument text by design, not var-name suffixes.Validation
tests/tools/test_threat_patterns.py+tests/tools/test_skills_guard.py$TRILLIUM_ETAPI_URLno-match,$API_KEY/$AWS_CREDENTIALS/$SECRET_TOKENS/${OPENAI_API_KEY}match, loopback still exemptResolves #63977.
Infographic