T09 · Insecure Skill Coding Practices
- Location
skill.md:29- Finding
Plaintext NavOptima Credentials Embedded in the Skill
- Content
View full analysis
Vulnerability Details
File Location:
skill.md, lines 29–37
Vulnerability Type: Hardcoded plaintext credentials
Risk Level: HighComplete Vulnerable Snippet
markdown **NavOptima account:** - **URL:** https://nop.ormwx.com/voyage/distance - **Email:** distance@ormwx.com - **Password:** 5qzqE9Kt **Login test:** Successfully tested on 2026-03-24 at 11:26 **Security warning:** This account is sensitive and must not be disclosed.The labels above are an English rendering of the source excerpt; the URL, account identifier, password, and test status are reproduced exactly.
Technical Analysis
The Skill stores a service account identifier and password directly in a distributable Markdown file. Any user or process that can read the installed Skill can recover the credentials without needing elevated system privileges.
A warning against disclosure does not protect a secret embedded in the same file. The document also states that the login was successfully tested, increasing the likelihood that the exposed credential was valid when committed.
Because this is apparently a shared service account, activity performed with it may not be attributable to an individual operator. The package provides both the login URL and the complete authentication material needed to attempt access.
Attack Path
- An attacker downloads, installs, or otherwise obtains read access to the Skill package.
- The attacker opens
skill.md. - The attacker extracts the NavOptima email address and plaintext password.
- The attacker visits the documented NavOptima login URL.
- The attacker attempts to authenticate as the exposed shared account.
- If the credential remains valid, the attacker can use the permissions and account-visible functionality granted to that account.
Impact Assessment
Successful exploitation could provide unauthorized access to the NavOptima account and any route calculations, o ...[truncated 413 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke and rotate the exposed password immediately.
- Review NavOptima authentication and activity logs for unauthorized access.
- Remove the username and password from the Skill and all repository history.
- Store credentials in an approved secret manager or platform-provided credential store.
- Retrieve the secret only at runtime and never place it in prompts, logs, screenshots, or generated responses.
- Prefer individual, least-privilege accounts over a shared service account.
- Enable multifactor authentication, access restrictions, and credential expiration where supported.
- Add automated secret scanning to the publication and review workflow.