T09 · Insecure Skill Coding Practices
- Location
SKILL.md:223- Finding
Hardcoded IMA API Credentials Exposed in Skill Documentation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:223-227andSKILL.md:294-298
Vulnerability Type: Hardcoded reusable API credentials
Risk Level: HighVulnerable Code
bash curl -X POST "https://ima.qq.com/openapi/note/v1/import_doc" \ -H "ima-openapi-clientid: d1cd187e233cb8fff251a16e2cf917e6" \ -H "ima-openapi-apikey: QXQQ9SbApkGn7FwOhm/M3vu8KqZkAccFzFVupdcPChLUAYclwKOYcXwQgYsYV3Vu/IvGrN9tyA==" \ -H "Content-Type: application/json" \ -d '{"content_format": 1, "content": "...", "folder_id": "folder94d1f87c74708a21"}'The same credential is repeated in the configuration section:
json { "client_id": "d1cd187e233cb8fff251a16e2cf917e6", "api_key": "QXQQ9SbApkGn7FwOhm/M3vu8KqZkAccFzFVupdcPChLUAYclwKOYcXwQgYsYV3Vu/IvGrN9tyA==", "notebook_id": "folder94d1f87c74708a21" }Technical Analysis
The Skill contains a plaintext client identifier and reusable API key. The accompanying command demonstrates exactly how to authenticate to the IMA import endpoint and identifies the target notebook.
Secrets embedded in a distributed Skill package are available to every person or process that can read the package, its source repository, build artifacts, logs, backups, or audit output. File permissions do not provide adequate protection once the Skill is distributed. If the credential remains active, an attacker can replay it independently of the Skill.
External IMA publishing may be part of the optional delivery functionality, but shipping a specific account credential is not necessary. The minimum-privilege design is to obtain a credential from the installing user at runtime and grant it only the permissions required to create the requested note.
Attack Path
- An attacker obtains a copy of the Skill package or reads
SKILL.md. - The attacker extracts the client ID, API key, notebook ID, API URL, and expected header names.
- The attacker constructs an authenticate ...[truncated 1332 chars]
- An attacker obtains a copy of the Skill package or reads
- Remediation
View remediation
Remediation Suggestions
- Revoke the exposed API key immediately and issue a replacement.
- Remove the credential from
SKILL.md, all examples, package artifacts, repository history, logs, and release archives. - Obtain credentials at runtime from a protected secret store or environment variables, for example:
bash -H "ima-openapi-clientid: ${IMA_CLIENT_ID}" \ -H "ima-openapi-apikey: ${IMA_API_KEY}" - Fail safely when credentials are absent; never recommend placing credentials directly in scheduled-task instructions.
- Require each installer to configure their own notebook identifier rather than shipping an account-specific destination.
- Grant the replacement credential only document-import access to the intended notebook, with no broader account permissions.
- Add automated secret scanning to source control and release pipelines.
- Prevent credentials from appearing in command-line arguments, diagnostic output, exception messages, or generated reports.
- Review external-service access logs for unauthorized requests made with the exposed credential.