T09 · Insecure Skill Coding Practices
- Location
SKILL.md:28- Finding
Reusable credentials and SSH private keys are transmitted through a third-party gateway
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:28,SKILL.md:56-59,SKILL.md:166-191,SKILL.md:386-440;schema.md:299-348
Vulnerability Type: Sensitive credential disclosure to an external service
Risk Level: HighVulnerable Code
SKILL.md:28:text scheme://username:password@hostname:port/pathSKILL.md:166-191:markdown **Optional fields:** - `options.timeout` (integer): Command timeout in seconds. Default: `30` - `options.private_key` (string): SSH private key in PEM format for key-based authentication. When provided, password in the URL can be omitted. - `options.known_hosts` (string): SSH known hosts entry for host verification **Example (password auth):** ```json { "action": "ssh_execute", "url": "ssh://deploy:s3cret@server.example.com:22", "content": "uptime" }Example (key-based auth):
json { "action": "ssh_execute", "url": "ssh://deploy@server.example.com:22", "content": "ls -la /var/log", "options": { "private_key": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----", "timeout": 60 } }text `SKILL.md:438-440`: ```markdown - Marketplace product: https://www.agentpmt.com/marketplace/multi-protocol-bridge - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchaseTechnical Analysis
The Skill instructs users to place reusable passwords directly in protocol URLs and permits complete SSH private keys to be supplied as request parameters. These values are then submitted to an AgentPMT-hosted MCP or REST gateway so that the gateway can connect to the destination service.
This design necessarily discloses the supplied authentication material to an intermediary. URL-embedded credentials are especially prone to exposure through request logging, telemetry, exception reports, tracing systems, ...[truncated 1785 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not transmit reusable SSH private keys or reusable account passwords to a third-party protocol gateway.
- Prefer local protocol clients operating inside the user's trusted execution boundary.
- Where remote execution is unavoidable, use short-lived, operation-scoped credentials or delegated tokens with strict destination, action, and expiration restrictions.
- Replace literal secret parameters with opaque secret references resolved only inside a trusted credential broker.
- Never embed credentials in URLs. Supply secrets through a dedicated protected credential channel that is excluded from request logs, traces, errors, and analytics.
- Require explicit, informed user approval before transmitting any credential or sensitive payload to an external service.
- Use restricted SSH certificates or keys with forced commands, source-address restrictions, short validity periods, and minimal account permissions.
- Document gateway-side encryption, access control, retention, deletion, audit logging, and incident-response guarantees.
- Automatically redact URL user information and private-key fields from all agent output, logs, telemetry, and error messages.
- Rotate any production credential that may already have been submitted through an inadequately controlled channel.