T09 · Insecure Skill Coding Practices
Error
- Location
scripts/provider-sync.js:21- Finding
Hardcoded Telegram Bot Credential in Executable Source
- Content
View full analysis
{ const parsedUrl = new URL(url); const options = { hostname: parsedUrl.hostname, port: 443, path: parsedUrl.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) } }; const req = https.request(options, (res) => { let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => resolve(data)); }); req.on('error', reject); req.write(payload); req.end(); }); } ``` ### Technical Analysis A Telegram bot token is a bearer credential: possession of the token is generally sufficient to authenticate requests to Telegram's Bot API. Embedding it directly in a distributed Skill makes it available to every person or process that can read the package. Although Telegram notifications are part of the declared provider-synchronization functionality, distributing a shared authentication secret is not necessary and violates least-secret and secure configuration principles. The token should be supplied at deployment time through a protected secret store or environment variable. The code transmits model names and synchronization summaries rather than provider API keys. No evidence was found tha ...[truncated 1609 chars]- Remediation
View remediation