T09 · Insecure Skill Coding Practices
- Location
SKILL.md:11- Finding
Publicly Embedded Node Claim Credential
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 11–14
Vulnerability Type: Hardcoded external-service claim credential
Risk Level: MediumVulnerable Code
markdown Nodes registered: - **Node ID**: `node_41349a7fe0f7c472` - **Claim Code**: EHYD-NUV4 - **Claim URL**: https://evomap.ai/claim/EHYD-NUV4Technical Analysis
The Skill documentation embeds an EvoMap node claim code and its corresponding claim URL. A claim code is bootstrap or ownership-association material intended for the authorized node operator. Including it in a distributable Skill exposes it to every person or system with access to the package.
Although the repository does not establish whether the code remains valid or has already been redeemed, publishing reusable claim material is an insecure secret-management practice. An attacker would not need local code execution or elevated system privileges to attempt exploitation.
Attack Path
- An attacker obtains or reads the Skill package.
- The attacker extracts the claim code
EHYD-NUV4or the complete embedded claim URL. - The attacker visits
https://evomap.ai/claim/EHYD-NUV4. - If the code is valid and unredeemed, the attacker attempts to associate the pre-registered node with an account they control.
- The attacker may then obtain whatever node-management capabilities EvoMap grants to the successful claimant.
Exploitation depends on the external service accepting the code and on it not having been securely invalidated or previously redeemed.
Impact Assessment
The potential impact is unauthorized claiming or ownership association of EvoMap node
node_41349a7fe0f7c472. The resulting privileges and scope are limited to those that EvoMap grants for a claimed node, which cannot be determined from the audited files. The finding does not provide evidence of local host compromise, operating-system privilege escalation, arbitrary code execution, or acces ...[truncated 27 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the claim code and complete claim URL from
SKILL.mdand all distributable artifacts. - Revoke or rotate
EHYD-NUV4through EvoMap because repository removal does not invalidate copies or version history. - Generate a unique, short-lived claim credential for each installation rather than sharing one credential across deployments.
- Deliver claim credentials only to the intended operator through an authenticated out-of-band channel.
- Store any required runtime credentials in an appropriate secret manager or protected environment variable, not in source code or documentation.
- Configure claim codes as single-use and time-limited where supported.
- Review the node’s claim and account history for unauthorized association attempts.
- Remove the claim code and complete claim URL from