T09 · Insecure Skill Coding Practices
- Location
scripts/get_key.py:39- Finding
Hard-Coded Production Database Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/get_key.py, lines 39-48
Vulnerability Type: Hard-coded credentials and insecure secret management
Risk Level: CriticalVulnerable Code
python def get_db_connection(): """Connect to ColdCore MySQL database.""" return mysql.connector.connect( host=os.environ.get("COLDCORE_HOST", "208.87.131.78"), user=os.environ.get("COLDCORE_USER", "avnadmin"), password=os.environ.get("COLDCORE_PASS", "lRHS2T8XagsA5z4u3ZYd"), database=os.environ.get("COLDCORE_DB", "lead_generator"), connect_timeout=10 )Technical Analysis
The script embeds a public database IP address, database username, plaintext password, and database name as fallback values. Consequently, environment variables are optional rather than mandatory, and anyone who obtains the Skill package also obtains credentials that can be used to attempt direct access to the remote ColdCore MySQL service.
Storing credentials in source code violates secure secret-management principles. Source files can be copied, published, cached, logged, included in backups, or retained in version-control history. The username
avnadminalso appears administrative, potentially granting substantially more access than the narrow read-and-update operations required by the key-rotation function.This access exceeds minimum privilege if the account can read or modify tables other than the specific fields needed in
scrape_sm_accounts. The audit could not verify the server-side grants, network allowlist, or TLS configuration, so the precise database privileges remain unknown.Attack Path
- An attacker obtains the Skill source through distribution, repository access, a package archive, or local filesystem access.
- The attacker extracts the default host, username, password, and database name from
get_db_connection(). - The attacker attempts a direct MySQL con ...[truncated 1119 chars]
- Remediation
View remediation
Remediation Suggestions
- Immediately revoke and rotate the exposed database password. Treat it as compromised even if the project was not intentionally published.
- Remove all secret fallback values from source code. Fail closed when required variables are absent:
python required = ("COLDCORE_HOST", "COLDCORE_USER", "COLDCORE_PASS", "COLDCORE_DB") missing = [name for name in required if not os.environ.get(name)] if missing: raise RuntimeError(f"Missing required configuration: {', '.join(missing)}") - Supply credentials through an approved secret manager or workload identity mechanism rather than command-line arguments, source files, or broadly readable environment files.
- Create a dedicated database identity for this Skill. Restrict it to the required columns and operations on
scrape_sm_accounts; do not use an administrative account. - Restrict database network access to approved workloads using firewall rules, private networking, or an authenticated proxy.
- Require certificate-validated TLS for the MySQL connection so credentials and returned API keys cannot traverse the network in plaintext.
- Review database access logs for use of the exposed account and inspect source-control history, build artifacts, logs, and backups for further copies of the secret.
- Add secret scanning to commits and release pipelines to prevent recurrence.