T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:30
- Finding
- Cryptographic Private Keys and API Credentials Are Stored in Plaintext## Vulnerability Details **File Location**: `SKILL.md:30-50`, `SKILL.md:56`, and `SKILL.md:227` **Vulnerability Type**: Plaintext storage of sensitive credentials **Risk Level**: High The Skill explicitly documents that account private keys are generated and saved in JSON configuration files without encryption. It also instructs users to place delegation-storage API credentials directly in the same configuration structure. ```text - Config path: `~/.gator-cli/permissions.json` (or `~/.gator-cli/profiles/<profile-name>.json`) - Delegations local cache: `~/.gator-cli/delegations/<profile-name>.json` when storage not configured ``` ```json { "delegationStorage": { "apiKey": "your-api-key", "apiKeyId": "your-api-key-id" }, "rpcUrl": "https://your-rpc-url.com" } ``` ```text Generate a private key and save config. Errors if the profile already exists. ``` ```text - **Private key security**: This is alpha version. Private keys are stored in plaintext JSON. Never use accounts with significant funds. ``` ### Technical Analysis A private key is a bearer credential that provides cryptographic control of the associated blockchain account. Storing it in an unencrypted JSON file means that access to the file is sufficient to copy and use the key; no additional password, hardware confirmation, or key-unwrapping operation is required. The configuration example also stores `apiKey` and `apiKeyId` as plaintext values. Depending on the permissions associated with those credentials, disclosure could allow unauthorized access to remote delegation storage. The documentation warns users about the plaintext storage model, but a warning does not mitigate the underlying exposure. The risk applies to local malware, other users on a shared system, overprivileged applications or agents, improperly configured backups, support bundles, and accidental publication of the profile directory. ### Attack Pat ...[truncated 1459 chars]
- Remediation
- ## Remediation Suggestions - Replace plaintext private-key storage with an OS credential vault, hardware wallet, encrypted keystore, or external signing service. - Require explicit signing confirmation for high-impact operations such as raw contract calls, ownership transfers, and unrestricted delegations. - Store API credentials in a secret manager or protected credential provider rather than directly in profile JSON. - If temporary file-based storage cannot be eliminated, encrypt secrets using a user-supplied credential and an authenticated, memory-hard key derivation scheme. - Create profile files and directories with owner-only permissions and verify permissions before every read or write. - Prevent profile files from being included in source control, cloud synchronization, telemetry, logs, crash reports, and support archives. - Add credential rotation and key-migration procedures for users of the alpha version. - Continue warning users not to use materially funded accounts until secure signer integration is available; this warning should supplement, not replace, technical controls.