T09 · Insecure Skill Coding Practices
Warning
- Location
references/auth-setup.md:18- Finding
Unsafe Collection, Temporary Storage, and Persistence of Authentication Secrets
- Content
View full analysis
Vulnerability Details
File Location:
references/auth-setup.md, lines 18–24, 50–57, 108–109, and 154–167
Vulnerability Type: Insecure credential handling and unsafe temporary-file usage
Risk Level: MediumVulnerable Instructions
Lines 18–24 instruct the agent to request an API key directly through the conversation:
markdown ## Step 1: Ask the user one question Ask the user exactly this, in a single message: > Do you have a TranscriptOut key already? Paste it and I'll wire it up. If not, give me an email > address and I'll open a free account for you: 100 credits included, no card asked. - If they paste a key (starts with `sk_`), go straight to **Storing the Key** below. - If they want a new account, go to **Path B**.Lines 50–57 direct the agent to write an authentication response containing a bearer token to a temporary file:
markdown **Pipe the response into a temporary file and build the next request by reading the token out of that file. Never echo the token on its own.** Several agent runtimes scrub anything shaped like `access_token` or a bearer token from tool output before the model sees it, so a printed token arrives as `[REDACTED]` and the flow dead-ends. File in, file out, one chained command. The response looks like this:Lines 108–109 apply the same file-based handling to the permanent API key:
markdown Same discipline as before: **response into a file, key read out of the file**, because `sk_`-prefixed values get scrubbed from tool output by the same runtimes.Lines 154–167 require persistent storage without prescribing a protected storage mechanism:
markdown ## Storing the Key You now have a string that starts with `sk_`. This is the `TRANSCRIPTOUT_API_KEY`. Store it persistently using whatever method is correct for this environment (which you determined in Step 0). Make sure it will be available in future sessions, including ...[truncated 3783 chars]- Remediation
View remediation
Remediation Suggestions
- Do not ask users to paste API keys into ordinary conversation messages. Use the agent runtime's protected secret-input interface so the value is not retained in chat history or routine telemetry.
- Store the API key only through an approved operating-system or runtime secret manager, such as a credential vault, keychain, encrypted secret store, or protected environment-secret facility.
- Explicitly prohibit persistence in shell history, command-line arguments, source-controlled files, world-readable configuration files, and plaintext shell profiles.
- If a temporary file is unavoidable, create it atomically with a facility such as
mktemp, place it in a user-private directory, and set permissions to0600before writing sensitive content. - Install cleanup traps before the first network request so temporary files are deleted on normal exit, errors, signals, and interruptions.
- Minimize stored material by parsing only the required field inside a protected process and immediately deleting the raw response body.
- Avoid printing, logging, or returning bearer tokens, API keys, complete authentication responses, or commands containing those values.
- Provide separate, explicit secret-storage procedures for every supported runtime rather than delegating persistence to an unspecified environment-dependent method.
- Verify the credential using redacted output and document immediate revocation and rotation procedures if a key is exposed.