What causes "service must not contain NUL bytes" in ComposioHQ/composio?

Sanitize/validate strings before calling the store

ComposioHQ/composio · error · KeyringError

Invalid

Invalid

Error message

service must not contain NUL bytes

What it means

The Linux secret-tool store rejects service strings containing NUL (\0) bytes because they cannot be passed as argv attributes to the secret-tool binary. KeyringError kind 'Invalid', param 'service'.

Source

Thrown at ts/packages/cli-keyring/src/stores/linux-secret-tool.ts:41

import { existsSync } from 'node:fs';
import type { CredentialStore, EntryModifiers } from '../core/store';
import { CredentialPersistence } from '../core/persistence';
import { KeyringError } from '../core/errors';
import {
  bytesToUtf8,
  decodeSecret,
  encodeSecret,
  runCommand,
  utf8ToBytes,
  type SpawnResult,
} from './shared';

const SECRET_TOOL_BIN = 'secret-tool';

function validateSpecifier(service: string, user: string): void {
  if (service.includes('\0')) {
    throw new KeyringError({
      kind: 'Invalid',
      param: 'service',
      reason: 'service must not contain NUL bytes',
    });
  }
  if (user.includes('\0')) {
    throw new KeyringError({
      kind: 'Invalid',
      param: 'user',
      reason: 'user must not contain NUL bytes',
    });
  }
}

function attributeArgs(
  service: string,
  user: string,
  modifiers: EntryModifiers

View on GitHub (pinned to 64b1b85502)

Solutions

Sanitize/validate strings before calling the store
Trace where the NUL entered the service name (buffer mishandling upstream)

Example fix

// before
store.setSecret(buf.toString('utf8'), user, secret);
// after
const svc = buf.toString('utf8').replace(/\0.*$/s, '');
store.setSecret(svc, user, secret);

Defensive patterns

Strategy: validation

Validate before calling

if (service.includes('\0')) throw new TypeError('NUL in service');

Type guard

const isCleanSpecifier = (s: string) => !s.includes('\0');

Prevention

Never build strings from raw buffers without NUL checks

When it happens

Trigger: Calling setSecret/getSecret/deleteCredential on the Linux secret-tool store with a service string containing '\0' (often from binary data or a truncated buffer).

Common situations: Concatenating buffers into strings, reading fixed-length binary fields, or fuzzed input reaching the keyring layer.

Related errors

AI-assisted analysis of ComposioHQ/composio@64b1b85502 (2026-08-28). Data as JSON: /api/errors/3979e9e58d8ff341. Report an issue: GitHub.