T09 · Insecure Skill Coding Practices
Error
- Location
scripts/twitter_oauth_client.py:342- Finding
Plaintext API Key Included in Request Bodies and Command Output
- Content
View full analysis
Vulnerability Details
File Location:
scripts/twitter_oauth_client.py:342-381, 458-478
Vulnerability Type: Sensitive credential exposure
Risk Level: HighVulnerable Code
python if result.get("ok") is False or result.get("code") != 200: return { "ok": False, "aisa_api_key": config["aisa_api_key"], "is_thread": should_thread, "total_chunks": len(chunks), "failed_at_chunk": index + 1, "results": publish_results, } latest_tweet_id = extract_tweet_id(result) if not latest_tweet_id: return { "ok": False, "aisa_api_key": config["aisa_api_key"], "is_thread": should_thread, "total_chunks": len(chunks), "failed_at_chunk": index + 1, "error": "Missing tweet_id in relay response.", "results": publish_results, } return { "ok": True, "aisa_api_key": config["aisa_api_key"], "is_thread": should_thread, "total_chunks": len(chunks), "results": publish_results, }python payload: Dict[str, Any] = { "aisa_api_key": config["aisa_api_key"], }python def command_authorize(args: argparse.Namespace) -> None: config = load_config(args) payload = {"aisa_api_key": config["aisa_api_key"]} result = send_json_request( f"{config['base_url']}/twitter/auth_twitter", payload, timeout=config["timeout"], aisa_api_key=config["aisa_api_key"], ) if result.get("ok") is False: print(json.dumps(result, indent=2, ensure_ascii=False)) sys.exit(1) auth_url = (result.get("data") or {}).get("auth_url") output = { "ok": result.get("code") == 200 and bool(auth_url), "aisa_api_key": config["aisa_api_key"], "authorization_url": auth_url, "raw_response": result, } print(json.dumps(output, indent=2, e ...[truncated 2340 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
aisa_api_keyfrom every returned result and CLI output structure. - Remove the key from JSON and multipart request bodies and authenticate exclusively with the HTTPS
Authorization: Bearerheader. - If the relay currently requires body-based authentication, update the client and server protocol together so the body field can be eliminated.
- Add centralized output sanitization that recursively redacts API keys, authorization headers, tokens, and similarly sensitive fields before serialization.
- Ensure error responses cannot reflect credentials received from the relay.
- Add automated tests asserting that command output and serialized payloads never contain the configured key.
- Review logs and transcripts generated by previous executions, remove exposed values where possible, and rotate any key that may already have been recorded.
- Remove