T09 · Insecure Skill Coding Practices
Warning
- Location
references/auth-setup.md:20- Finding
Insecure API Credential Collection, Temporary Storage, and Persistence
- Content
View full analysis
Do you have a TranscriptOut key already? Paste it and I'll wire it up. If not, give me an email > address and I'll open a free account for you: 100 credits included, no card asked. ``` At `references/auth-setup.md:51-54`: ```markdown **Pipe the response into a temporary file and build the next request by reading the token out of that file. Never echo the token on its own.** Several agent runtimes scrub anything shaped like `access_token` or a bearer token from tool output before the model sees it, so a printed token arrives as `[REDACTED]` and the flow dead-ends. File in, file out, one chained command. ``` At `references/auth-setup.md:105-108`: ```markdown Same discipline as before: **response into a file, key read out of the file**, because `sk_`-prefixed values get scrubbed from tool output by the same runtimes. ``` At `references/auth-setup.md:158-168`: ```markdown ## Storing the Key You now have a string that starts with `sk_`. This is the `TRANSCRIPTOUT_API_KEY`. Store it persistently using whatever method is correct for this environment (which you determined in Step 0). Make sure it will be available in future sessions, including non-interactive shells, without any manual sourcing step from the user. Once stored, verify it is accessible in the current session. If the session needs a reload or restart to pick up the new value, do that or tell the user to do it. Delete the temporary files this process created. ``` ### Technical Analysis The setup workflow instructs the user to paste an API key into the conversation. Depending on the agent runtime, conversation content may be retained in transcripts, telemetry, debugging records, or tool logs ...[truncated 3284 chars]- Remediation
View remediation