T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/twitter_oauth_client.py:342
- Finding
- Plaintext API Key Included in Request Bodies and Command Output## Vulnerability Details **File Location**: `scripts/twitter_oauth_client.py:342-381, 458-478` **Vulnerability Type**: Sensitive credential exposure **Risk Level**: High ### Vulnerable Code ```python if result.get("ok") is False or result.get("code") != 200: return { "ok": False, "aisa_api_key": config["aisa_api_key"], "is_thread": should_thread, "total_chunks": len(chunks), "failed_at_chunk": index + 1, "results": publish_results, } latest_tweet_id = extract_tweet_id(result) if not latest_tweet_id: return { "ok": False, "aisa_api_key": config["aisa_api_key"], "is_thread": should_thread, "total_chunks": len(chunks), "failed_at_chunk": index + 1, "error": "Missing tweet_id in relay response.", "results": publish_results, } return { "ok": True, "aisa_api_key": config["aisa_api_key"], "is_thread": should_thread, "total_chunks": len(chunks), "results": publish_results, } ``` ```python payload: Dict[str, Any] = { "aisa_api_key": config["aisa_api_key"], } ``` ```python def command_authorize(args: argparse.Namespace) -> None: config = load_config(args) payload = {"aisa_api_key": config["aisa_api_key"]} result = send_json_request( f"{config['base_url']}/twitter/auth_twitter", payload, timeout=config["timeout"], aisa_api_key=config["aisa_api_key"], ) if result.get("ok") is False: print(json.dumps(result, indent=2, ensure_ascii=False)) sys.exit(1) auth_url = (result.get("data") or {}).get("auth_url") output = { "ok": result.get("code") == 200 and bool(auth_url), "aisa_api_key": config["aisa_api_key"], "authorization_url": auth_url, "raw_response": result, } print(json.dumps(output, indent=2, e ...[truncated 2340 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `aisa_api_key` from every returned result and CLI output structure. 2. Remove the key from JSON and multipart request bodies and authenticate exclusively with the HTTPS `Authorization: Bearer` header. 3. If the relay currently requires body-based authentication, update the client and server protocol together so the body field can be eliminated. 4. Add centralized output sanitization that recursively redacts API keys, authorization headers, tokens, and similarly sensitive fields before serialization. 5. Ensure error responses cannot reflect credentials received from the relay. 6. Add automated tests asserting that command output and serialized payloads never contain the configured key. 7. Review logs and transcripts generated by previous executions, remove exposed values where possible, and rotate any key that may already have been recorded.