T09 · Insecure Skill Coding Practices
- Location
SKILL.md:27- Finding
Agent Password Is Transmitted Through the Chat Channel
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:27
Vulnerability Type: Plaintext transmission of a sensitive operational credential
Risk Level: HighVulnerable Snippet
markdown | **Agent Password** — a scoped, revocable credential generated inside WalletChan. Unlocks only the review UI (see Security Model). | User-supplied at runtime, in chat, per session. | User pastes it to the agent only when needed. The agent types it into the extension's unlock field and nowhere else. | **Never persisted.** Not an env var, not read from disk, not logged, not echoed. Treated as ephemeral session input. Rotate/revoke in WalletChan Settings any time. |Technical Analysis
The skill explicitly requires the user to paste the Agent Password into the chat. Chat input is ordinarily transmitted to the agent service and may pass through API gateways, telemetry, abuse-monitoring systems, conversation storage, or third-party model infrastructure. Consequently, the assertion that the credential is never logged or persisted cannot be enforced by this skill.
Although the Agent Password is described as narrower than the wallet Master Password, it is still a security-sensitive credential because it unlocks the wallet's transaction and signature review interface and enables confirmation or rejection of pending requests. Sending it through chat exceeds the minimum privilege required: browser automation can enter a secret supplied through a local secret prompt without exposing the value to the language model or conversation history.
This is also the most likely source of the static pre-scan warning concerning sensitive information sent over the network.
Attack Path
- The user follows the skill instructions and pastes the Agent Password into the chat.
- The plaintext credential is transmitted through the chat or API infrastructure.
- A party with access to conversation records, telemetry, proxy logs, a compromised client, ...[truncated 1180 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not request passwords or other credentials through chat.
- Use a trusted local secret-entry mechanism that bypasses the model context, such as a browser-side user prompt, OS credential broker, or human-entered extension field.
- Require the user to type the Agent Password directly into WalletChan while the agent pauses automation.
- Ensure automation tools receive only a success/failure result and never the plaintext value.
- Remove claims such as “never logged” unless the complete transport and processing path technically enforces that property.
- Use short-lived, single-session authorization tokens bound to a specific browser instance and intended transaction where possible.
- Automatically revoke or expire operational credentials after use and provide the user with a visible session-termination control.
- Document that conversation services may retain submitted content and explicitly prohibit entering either the Master Password or Agent Password into chat.