T09 · Insecure Skill Coding Practices
- Location
references/api_reference.md:920- Finding
Hard-Coded Postman API Access Keys
- Content
View full analysis
Vulnerability Details
File Location:
references/api_reference.md, lines 920 and 925
Vulnerability Type: Plaintext hard-coded credentials
Risk Level: MediumVulnerable code at line 920:
text https://api.postman.com/collections/36945960-f299f4ac-3cc4-4046-9265-3ca292b35deb?access_key=PMAT-01JP73Q6C4P7EJV2P4WF4MVN3EVulnerable code at line 925:
text https://api.postman.com/collections/36945960-f8cac0c6-61f5-4cae-acdd-8c8bf5d2a7f2?access_key=PMAT-01JP73ZAWG57SVKBW7VKYCAYBSTechnical Analysis
Two credential-like Postman access keys are embedded in plaintext URL query parameters. Any party that can read the skill package, repository history, generated documentation, logs, or copied links can obtain these keys without authentication.
URL query parameters are especially prone to secondary disclosure because complete URLs may be retained in browser history, proxy logs, monitoring systems, command histories, and referrer data. The keys can be submitted directly to the referenced Postman API collection endpoints. Their precise permissions and current validity cannot be established from the audited files, so the finding does not demonstrate access beyond whatever privileges Postman assigned to them.
Attack Path
- Obtain a copy of the skill package or access its documentation or repository history.
- Read lines 920 and 925 of
references/api_reference.md. - Extract either value beginning with
PMAT-from theaccess_keyquery parameter. - Send a request to the corresponding
api.postman.com/collections/...URL with the exposed key. - Retrieve any collection data authorized by that key.
- Retain or redistribute the key until it is revoked or expires.
Impact Assessment
Successful exploitation may disclose the referenced Postman collections and any request definitions, endpoint details, examples, or configuration stored in them. If the keys grant broader permissio ...[truncated 447 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke both exposed Postman access keys immediately and verify their activity logs for unauthorized use.
- Generate replacement credentials only if operationally required, applying the narrowest available permissions and expiration period.
- Remove credential-bearing URLs from the current files and all accessible repository history, releases, archives, and generated documentation.
- Replace the links with credential-free public collection URLs. If authentication is necessary, require users to supply their own token through a protected environment variable or secret manager.
- Avoid credentials in URL query parameters. Pass secrets through supported authorization headers or secure client configuration.
- Enable automated secret scanning in pre-commit hooks and CI, including detection for
PMAT-tokens andaccess_keyparameters. - Review logs, tickets, chat messages, and mirrors where these complete URLs may have been copied, and remove or redact them where possible.