T09 · Insecure Skill Coding Practices
- Location
templates/platform-deployment-intake.md:10- Finding
Plaintext Credential Collection in a Workspace Template
- Content
View full analysis
Vulnerability Details
File Location:
templates/platform-deployment-intake.md:10-13
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: MediumComplete Vulnerable Snippet:
markdown ## What this platform requires - bot / app / account: - token / credential: - channel / group / chat:Technical Analysis
The deployment intake template includes a field where users may enter a platform token or credential. The broader workflow instructs users to obtain bot tokens or application credentials for Telegram, Feishu, and Discord, while generated documents may be written into the target agent workspace.
The package provides no corresponding instruction to:
- Keep secret values out of workspace documents and chat history.
- Use placeholders or redacted identifiers.
- Store credentials in environment variables or an approved secret manager.
- Exclude completed intake documents from version control.
- Restrict access permissions or rotate accidentally disclosed credentials.
Consequently, a user following the template literally may persist a live credential in plaintext. Such a document could subsequently be included in source control, backups, logs, shared workspace context, or future agent sessions.
This finding concerns unsafe secret-handling guidance. The audit found no evidence that the skill itself transmits credentials externally or intentionally steals them.
Attack Path
- The skill initiates the documented platform-deployment workflow.
- The user creates a bot or application and obtains its platform credential.
- The user enters the live secret into the template's
token / credentialfield. - The completed intake document is saved in the target agent workspace.
- The workspace is committed, backed up, shared, logged, or exposed to another agent or collaborator.
- An unauthorized party retrieves the credential and uses the associated platform API as the ...[truncated 872 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove the free-text secret field and replace it with a non-sensitive status field:
markdown - Credential configured in approved secret storage: yes / no - Credential reference or environment-variable name: - Never enter the credential value in this document. -
Add an explicit rule to
SKILL.md, the deployment guide, and the template prohibiting secrets in:- Workspace documents.
- Memory files.
- Chat messages.
- Reports and handoff maps.
- Source control.
-
Require platform credentials to be supplied through environment variables, encrypted deployment-platform secret storage, or an approved secrets manager.
-
Permit only redacted metadata in generated documents, such as the credential name, owner, creation date, final four identifier characters, and rotation status.
-
Add repository protections, including secret-scanning hooks and ignore rules for local deployment configuration containing sensitive values.
-
Apply least-privilege platform scopes and restrict bot access to only the required chats, channels, events, and API operations.
-
Document an incident procedure requiring immediate credential revocation and rotation if a live secret is entered into chat, memory, a workspace document, a commit, or a log.
-