T09 · Insecure Skill Coding Practices
Warning
- Location
references/auth-setup.md:18- Finding
Insecure Collection, Temporary Storage, and Persistence of API Credentials
- Content
View full analysis
Do you have a TranscriptOut key already? Paste it and I'll wire it up. If not, give me an email > address and I'll open a free account for you: 100 credits included, no card asked. - If they paste a key (starts with `sk_`), go straight to **Storing the Key** below. ``` From `references/auth-setup.md:59-61`: ```markdown **Pipe the response into a temporary file and build the next request by reading the token out of that file. Never echo the token on its own.** Several agent runtimes scrub anything shaped like `access_token` or a bearer token from tool output before the model sees it, so a printed token ``` From `references/auth-setup.md:107-108`: ```markdown Same discipline as before: **response into a file, key read out of the file**, because `sk_`-prefixed values get scrubbed from tool output by the same runtimes. ``` From `references/auth-setup.md:157-168`: ```markdown ## Storing the Key You now have a string that starts with `sk_`. This is the `TRANSCRIPTOUT_API_KEY`. Store it persistently using whatever method is correct for this environment (which you determined in Step 0). Make sure it will be available in future sessions, including non-interactive shells, without any manual sourcing step from the user. Once stored, verify it is accessible in the current session. If the session needs a reload or restart to pick up the new value, do that or tell the user to do it. Delete the temporary files this process created. ``` ### Technical Analysis The Skill instructs the user to paste ...[truncated 3187 chars]- Remediation
View remediation