T09 · Insecure Skill Coding Practices
Warning
- Location
references/auth-setup.md:17- Finding
Insecure Collection and Persistent Storage of Authentication Credentials
- Content
View full analysis
Do you have a TranscriptOut key already? Paste it and I'll wire it up. If not, give me an email > address and I'll open a free account for you: 100 credits included, no card asked. ``` `references/auth-setup.md:53-57` ```text **Pipe the response into a temporary file and build the next request by reading the token out of that file. Never echo the token on its own.** Several agent runtimes scrub anything shaped like `access_token` or a bearer token from tool output before the model sees it, so a printed token arrives as `[REDACTED]` and the flow dead-ends. File in, file out, one chained command. ``` `references/auth-setup.md:105-107` ```text Same discipline as before: **response into a file, key read out of the file**, because `sk_`-prefixed values get scrubbed from tool output by the same runtimes. ``` `references/auth-setup.md:150-158` ```text ## Storing the Key You now have a string that starts with `sk_`. This is the `TRANSCRIPTOUT_API_KEY`. Store it persistently using whatever method is correct for this environment (which you determined in Step 0). Make sure it will be available in future sessions, including non-interactive shells, without any manual sourcing step from the user. Once stored, verify it is accessible in the current session. If the session needs a reload or restart to pick up the new value, do that or tell the user to do it. Delete the temporary files this process created. ``` ### Technical Analysis The setup procedure asks the user to paste an API key directly into the Agent conversation. This can place the credential in conversation history, runtime telemetry, model context, or tool logs. The a ...[truncated 2475 chars]- Remediation
View remediation