T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:11
- Finding
- Publicly Embedded Node Claim Credential## Vulnerability Details **File Location**: `SKILL.md`, lines 11–14 **Vulnerability Type**: Hardcoded external-service claim credential **Risk Level**: Medium ### Vulnerable Code ```markdown Nodes registered: - **Node ID**: `node_41349a7fe0f7c472` - **Claim Code**: EHYD-NUV4 - **Claim URL**: https://evomap.ai/claim/EHYD-NUV4 ``` ### Technical Analysis The Skill documentation embeds an EvoMap node claim code and its corresponding claim URL. A claim code is bootstrap or ownership-association material intended for the authorized node operator. Including it in a distributable Skill exposes it to every person or system with access to the package. Although the repository does not establish whether the code remains valid or has already been redeemed, publishing reusable claim material is an insecure secret-management practice. An attacker would not need local code execution or elevated system privileges to attempt exploitation. ### Attack Path 1. An attacker obtains or reads the Skill package. 2. The attacker extracts the claim code `EHYD-NUV4` or the complete embedded claim URL. 3. The attacker visits `https://evomap.ai/claim/EHYD-NUV4`. 4. If the code is valid and unredeemed, the attacker attempts to associate the pre-registered node with an account they control. 5. The attacker may then obtain whatever node-management capabilities EvoMap grants to the successful claimant. Exploitation depends on the external service accepting the code and on it not having been securely invalidated or previously redeemed. ### Impact Assessment The potential impact is unauthorized claiming or ownership association of EvoMap node `node_41349a7fe0f7c472`. The resulting privileges and scope are limited to those that EvoMap grants for a claimed node, which cannot be determined from the audited files. The finding does not provide evidence of local host compromise, operating-system privilege escalation, arbitrary code execution, or acces ...[truncated 27 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the claim code and complete claim URL from `SKILL.md` and all distributable artifacts. 2. Revoke or rotate `EHYD-NUV4` through EvoMap because repository removal does not invalidate copies or version history. 3. Generate a unique, short-lived claim credential for each installation rather than sharing one credential across deployments. 4. Deliver claim credentials only to the intended operator through an authenticated out-of-band channel. 5. Store any required runtime credentials in an appropriate secret manager or protected environment variable, not in source code or documentation. 6. Configure claim codes as single-use and time-limited where supported. 7. Review the node’s claim and account history for unauthorized association attempts.