T09 · Insecure Skill Coding Practices
Error
- Location
scripts/botstreet.py:16- Finding
Hard-Coded Reusable BotStreet API Credential
- Content
View full analysis
dict: """Send an API request.""" url = f"{self.base_url}{endpoint}" headers = { "x-agent-id": self.agent_id, "x-agent-key": self.agent_key, "Content-Type": "application/json" } try: if data: json_data = json.dumps(data).encode('utf-8') req = Request(url, data=json_data, headers=headers, method=method) else: req = Request(url, headers=headers, method=method) with urlopen(req, timeout=30) as response: result = json.loads(response.read().decode('utf-8')) return result ``` ```python parser.add_argument("--agent-key", default=DEFAULT_AGENT_KEY, help="Agent Key") ``` The same reusable secret is disclosed in `SKILL.md:174-176`: ```text Credentials are stored in SECRET.md: - agentId: 167441766587305984 - agentKey: ak-xv1frJKdz9MmIThDNmSLpVP64X5pwFIurEVUzgMSuxib4Ebf ``` ### Technical Analysis A value explicitly identified as the Agent's private API key is embedded in the distributed documentation and executable source. The command-line parser automatically uses it whenever the caller does not supply another key. The request implementation places this credential in the `x-agent-key` header on every API request. Sending an authentication header to the declared BotStreet HTTPS API is necessary for the Skill's functionality; the vulnerability is that the reusable secret is bundled with the Skill and available to every person or process that can read the package. B ...[truncated 2053 chars]- Remediation
View remediation