T09 · Insecure Skill Coding Practices
- Location
README.md:63- Finding
Documentation Encourages Plaintext API Key Disclosure and Storage
- Content
View full analysis
Vulnerability Details
File Location:
README.md:63-79
Vulnerability Type: Plaintext credential handling
Risk Level: MediumVulnerable Snippet
markdown ## 🔧 配置 API Key（可选，推荐） 配置 API Key 后可获取更丰富的元数据（期刊分区、被引次数等）。无 Key 时自动使用 Semantic Scholar 免费通道，功能不受影响。 ### Web of Science API Key 1. 访问 [Clarivate Developer Portal](https://developer.clarivate.com) 2. 注册账号并申请 **Web of Science Core Collection API** Key（免费） 3. 在 WorkBuddy 对话中告知 Key，或直接修改 `SKILL.md` 中的配置 ### Springer Nature API Key 1. 访问 [Springer Nature API](https://dev.springernature.com) 2. 注册后即时生成免费 API Key 3. 同上方式配置 > ⚠️ **注意**：API Key 为个人资产，请勿提交到公开仓库。本仓库的 `scripts/` 目录不含任何 Key。The security-relevant instruction on line 71 translates to: “Provide the key in a WorkBuddy conversation, or directly modify the configuration in
SKILL.md.”Technical Analysis
The documentation recommends two insecure secret-handling methods:
- Entering an API key into a conversation, where it may remain in chat history, telemetry, exports, or shared workspace records.
- Writing an API key into
SKILL.md, where it becomes ordinary plaintext project content that may be copied into archives, shared with collaborators, or committed to source control.
The warning not to commit keys does not adequately mitigate the preceding instruction to place them in a project file. These methods are also unnecessary for the Skill’s core functionality because the bundled PubMed and Semantic Scholar scripts operate without API keys. The separate API reference already describes environment-variable-based configuration.
No hardcoded real credential was found, and the reviewed scripts do not exfiltrate credentials to unrelated hosts.
Attack Path
- A user follows the documented configuration instructions.
- The user submits a Web of Science or Springer API key in a WorkBuddy conversation, or writes it into
SKILL.md. - The conversation, workspace, Skill archive, backup, or repository is later exported, ...[truncated 949 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the recommendation to provide API keys through chat or store them in
SKILL.md. - Require a platform-managed secret store where available.
- Otherwise, accept credentials only through environment variables such as
WOS_API_KEYandSPRINGER_API_KEY. - Ensure secrets are never printed in command output, generated reports, exceptions, telemetry, or debug logs.
- Add secret-bearing local configuration files to
.gitignoreif such files are supported, and provide only sanitized example files. - Clearly state that API keys are optional and that anonymous PubMed and Semantic Scholar access is the default least-privilege mode.
- Recommend immediate key revocation and rotation if a key has previously been entered into chat, committed, or included in an exported Skill package.
- Add automated secret scanning to repository and release workflows.
- Remove the recommendation to provide API keys through chat or store them in