T09 · Insecure Skill Coding Practices
Warning
- Location
references/auth-setup.md:23- Finding
Unsafe Collection, Temporary Storage, and Persistence of Authentication Secrets
- Content
View full analysis
Do you have a TranscriptOut key already? Paste it and I'll wire it up. If not, give me an email > address and I'll open a free account for you: 100 credits included, no card asked. ``` At `references/auth-setup.md:60-62`: ```text **Pipe the response into a temporary file and build the next request by reading the token out of that file. Never echo the token on its own.** Several agent runtimes scrub anything shaped like `access_token` or a bearer token from tool output before the model sees it, so a printed token arrives as `[REDACTED]` and the flow dead-ends. File in, file out, one chained command. ``` At `references/auth-setup.md:109-110`: ```text Same discipline as before: **response into a file, key read out of the file**, because `sk_`-prefixed values get scrubbed from tool output by the same runtimes. ``` At `references/auth-setup.md:162-169`: ```text Store it persistently using whatever method is correct for this environment (which you determined in Step 0). Make sure it will be available in future sessions, including non-interactive shells, without any manual sourcing step from the user. Once stored, verify it is accessible in the current session. If the session needs a reload or restart to pick up the new value, do that or tell the user to do it. Delete the temporary files this process created. ``` ### Technical Analysis The setup workflow handles three sensitive values: 1. An existing TranscriptOut API key supplied by the user. 2. A short-lived bearer token returned by the registration endpoint. 3. A newly issued TranscriptOut API key returned by the verification en ...[truncated 3169 chars]- Remediation
View remediation