T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:718- Finding
API Key Disclosed Through Troubleshooting Command
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 718–723
Vulnerability Type: API credential exposure through terminal output
Risk Level: MediumVulnerable Code:
markdown 1. Check that the `SKILLBOSS_API_KEY` environment variable is set: ```bash echo $SKILLBOSS_API_KEYtext ### Technical Analysis The troubleshooting instructions print the complete value of `SKILLBOSS_API_KEY` to standard output. The key is subsequently used as a bearer credential for authenticated requests to the SkillBoss API. Printing a secret is unnecessary when checking whether an environment variable is configured. Terminal output can be retained in CI/CD logs, Agent tool histories, shell transcripts, screen recordings, or support diagnostics. Anyone who obtains that output may recover the credential without needing access to the original environment. The authenticated network transmission of this key to `https://api.skillboss.com/v1/run` is consistent with the Skill's declared functionality. The vulnerability is specifically the avoidable disclosure through `echo`, not its intended use in the API authorization header. ### Attack Path 1. A user or Agent follows the documented API-key troubleshooting procedure. 2. `echo $SKILLBOSS_API_KEY` writes the complete bearer credential to standard output. 3. The output is retained in an execution log, conversation history, terminal transcript, recording, or support attachment. 4. An unauthorized person gains access to that retained output and extracts the key. 5. The person submits authenticated requests to the SkillBoss API using the exposed credential. 6. The person can perform operations permitted by the key until it is revoked, rotated, or otherwise invalidated. ### Impact Assessment Successful exploitation grants the attacker the API privileges assigned to the compromised key; it does not directly provide local system privileges. Depending on account configura ...[truncated 422 chars]- Remediation
View remediation
Remediation Suggestions
Replace the secret-printing command with a non-disclosing presence check:
bash if [ -n "${SKILLBOSS_API_KEY:-}" ]; then echo "SKILLBOSS_API_KEY is set" else echo "SKILLBOSS_API_KEY is not set" fiAdditional hardening measures:
- Explicitly warn users never to print, paste, or record the API key.
- Redact bearer tokens from application, CI/CD, Agent, proxy, and debugging logs.
- Rotate any key that has appeared in persistent or shared output.
- Assign the key only the minimum API permissions required for messaging tasks.
- Apply usage limits, monitoring, and alerts for unusual messaging activity or unexpected costs.
- Store the key in an approved secret manager rather than plaintext configuration or command history.
- Ensure error handling never includes authorization headers or environment-variable values.