T09 · Insecure Skill Coding Practices
- Location
references/environment-setup.md:88- Finding
Weak Hardcoded Database Credentials in Generated Configuration
- Content
View full analysis
Vulnerability Details
File Location:
references/environment-setup.md:88-90
Vulnerability Type: Hardcoded weak database credentials
Risk Level: MediumVulnerable Code
yaml spring: datasource: url: jdbc:mysql://localhost:3306/demo username: root password: 123456The same insecure credential pattern also appears at
references/environment-setup.md:196-199:yaml ds: schema: demo jdbcUrl: jdbc:mysql://localhost:3306/demo?useUnicode=true&characterEncoding=utf8 driverClassName: com.mysql.cj.jdbc.Driver username: root password: 123456Technical Analysis
The environment setup reference presents the privileged MySQL
rootaccount and the weak literal password123456as preferred configuration examples. The primary skill directs agents handling environment setup to read this reference, creating a realistic chance that these values will be copied into generated application configuration without replacement.This is not evidence of a leaked production secret. However, it is an insecure code-generation practice because it normalizes:
- A predictable password.
- Plaintext credentials in configuration files.
- Use of a highly privileged database account.
- Storage of credentials in files likely to enter version control or deployment artifacts.
The vulnerability becomes exploitable when generated configuration is retained in a real environment and the database is reachable by an attacker.
Attack Path
- An agent loads the skill while creating or integrating an xbatis application.
- The agent follows the environment setup reference and generates the documented datasource configuration.
- A developer retains
root/123456, potentially committing it to source control or deploying it unchanged. - The database becomes reachable through the application network, an exposed database port, a compromised internal host, or another network foothold.
- An attacker authenticates to MySQL using the p ...[truncated 666 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace concrete credentials with mandatory environment substitutions:
yaml spring: datasource: url: ${DB_URL} username: ${DB_USERNAME} password: ${DB_PASSWORD}yaml ds: schema: ${DB_SCHEMA} jdbcUrl: ${DB_URL} driverClassName: com.mysql.cj.jdbc.Driver username: ${DB_USERNAME} password: ${DB_PASSWORD}- Explicitly instruct generated projects to use a dedicated, least-privileged application account rather than
root. - Require startup to fail when required secret variables are absent; do not provide insecure fallback values.
- Store deployed credentials in an approved secret manager or container-orchestration secret facility.
- Add secret scanning and configuration linting to CI so literal passwords and privileged database usernames are rejected.
- Clarify that any local-development example must use placeholders and must never be committed or reused in test, staging, or production environments.