T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:47
- Finding
- Predictable Hardcoded Database Credential<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 47–49 and 68–70 **Vulnerability Type**: Hardcoded default database credential **Risk Level**: Medium ### Vulnerable Code ```bash sudo mysql -e "CREATE DATABASE IF NOT EXISTS fastapiadmin CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" sudo mysql -e "CREATE USER IF NOT EXISTS 'fastapiadmin'@'localhost' IDENTIFIED BY 'fastapiadmin123';" sudo mysql -e "GRANT ALL PRIVILEGES ON fastapiadmin.* TO 'fastapiadmin'@'localhost'; FLUSH PRIVILEGES;" ``` The deployment instructions subsequently direct the user to place the same password in the backend configuration: ```text DATABASE_USER = "fastapiadmin" DATABASE_PASSWORD = "fastapiadmin123" REDIS_PASSWORD = "" ``` ### Technical Analysis The Skill assigns every deployment the publicly documented and predictable password `fastapiadmin123`. This is not a secret once the Skill is distributed. The account is granted all privileges on the `fastapiadmin` database. The initial MySQL host restriction to `localhost` reduces remote exposure, but it does not make the credential safe. Any compromised local application, shell account, server-side request capability, or database proxy can attempt authentication using the known password. A later configuration change that exposes MySQL beyond localhost would make the account directly vulnerable to remote authentication. The password may also remain in shell history, process argument records, installation logs, and copied configuration files. ### Attack Path 1. An attacker obtains database connectivity through local code execution, a compromised application component, an exposed MySQL listener, or an unintended proxy. 2. The attacker identifies that the deployment follows these public instructions. 3. The attacker authenticates as `fastapiadmin` with the known password `fastapiadmin123`. 4. The attacker exercises the account's privileges over the entire `fastapiadmin` database. 5. Application records can the ...[truncated 575 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Generate a unique, cryptographically random password for every installation, for example with `openssl rand`. 2. Avoid putting the password directly in command-line arguments, where it may be exposed through shell history or process inspection. 3. Supply the SQL through a protected temporary input file or standard input, and remove temporary material immediately after use. 4. Store the backend credential in a file readable only by the service account, with permissions such as `0600`. 5. Keep MySQL bound to the required local interface and enforce host firewall restrictions. 6. Grant only the specific database privileges required by the application instead of `ALL PRIVILEGES` where practical. 7. Document a credential rotation procedure and require rotation if the example credential was previously deployed. ]]>