T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:32- Finding
Plaintext API Key Storage and Disclosure into Agent Context
- Content
View full analysis
/dev/null || echo "NOT_CONFIGURED" If the config above is NOT_CONFIGURED, ask the user: - What is your deAPI API key? (get one at https://deapi.ai, free $5 credit) Then write the answer to ${CLAUDE_SKILL_DIR}/config.json as `{ "api_key": "their_key" }`. Alternatively, the user can set the `DEAPI_API_KEY` environment variable directly, which takes priority over config.json. ``` The corresponding credential-loading code is: ```bash deapi_check_auth() { if [[ -z "${DEAPI_API_KEY:-}" ]]; then # Try config.json fallback (written by skill setup flow) local config_file="${SCRIPT_DIR}/../config.json" if [[ -f "$config_file" ]]; then DEAPI_API_KEY=$(jq -r '.api_key // empty' "$config_file" 2>/dev/null) export DEAPI_API_KEY fi fi ``` ### Technical Analysis The setup procedure instructs the agent to save the deAPI bearer token directly in `config.json` as plaintext. It does not require restrictive file permissions, validate file ownership, or use an operating-system credential store. More critically, the dynamic instruction at `SKILL.md:33` reads the entire configuration file. Because the file contains the raw API key, loading or rendering this section can place the credential in agent context, execution traces, session transcripts, debugging output, or other records associated with the agent framework. The runtime fallback in `common.sh` also exports the recovered key into the process environment. This is needed for API authentication, but it increases exposure to child processes and should not be combined with unrestricted plaintext storage or context rendering. ### Attack Path 1. A user supplies a deAPI API key during ...[truncated 1151 chars]- Remediation
View remediation