T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:268
- Finding
- Bearer Authentication Token Exposed Through Raw Response Logging<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 268-282 **Vulnerability Type**: Sensitive credential exposure through logging **Risk Level**: High ### Vulnerable Code Snippet ```markdown **Auth token reuse (critical):** - Perform nonce+verify once, then reuse token for all challenge/submit calls until it expires. - Do not run auth handshake inside the normal mining loop. - Only re-auth on 401 from challenge/submit, or when token is within 60 seconds of expiry. **Auth handshake rules:** - **Always** send `Authorization: Bearer <token>` on `GET /v1/challenge` and `POST /v1/submit` when auth is enabled. - Build sign/verify JSON with `jq --arg` — never use manual string interpolation of the multi-line message. - Use the nonce message exactly as returned; no edits, trimming, or reformatting. - Do not reuse an auth nonce — each handshake gets a fresh nonce from `/v1/auth/nonce`. - Log raw HTTP status and response body for `/v1/auth/nonce`, `/v1/auth/verify`, and `/v1/challenge` to classify failures quickly. ``` The authentication flow stores the token directly from the verification response: ```bash VERIFY_RESPONSE=$(curl -s -X POST "${COORDINATOR_URL:-https://coordinator.agentmoney.net}/v1/auth/verify" \ -H "Content-Type: application/json" \ -d "...") TOKEN=$(echo "$VERIFY_RESPONSE" | jq -r '.token') ``` ### Technical Analysis The Skill instructs the Agent to log the complete response body returned by `/v1/auth/verify`. That response contains the reusable bearer token later placed in the `Authorization` header for challenge and submission requests. Consequently, the token can be copied into terminal transcripts, CI logs, shell diagnostics, Agent telemetry, centralized logging systems, or other storage with a broader audience and longer retention period than the token itself requires. The instruction conflicts with least-privilege credential handling because troubleshooting only requires status codes and sanitized error fields, n ...[truncated 1359 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the instruction to log raw response bodies from authentication endpoints. - Log only the HTTP status, request correlation ID, sanitized error code, and a redacted error message. - Explicitly replace `.token`, `.signature`, authorization headers, wallet API keys, and nonce messages with `[REDACTED]` before diagnostic output. - Keep bearer tokens in memory where possible and avoid shell tracing while they are present. - Disable `set -x` around authentication operations and ensure Agent or CI telemetry cannot capture environment variables or command output. - Apply restrictive permissions and short retention periods to any unavoidable authentication logs. - Prefer short-lived, narrowly scoped tokens and provide a revocation mechanism for suspected exposure. ]]>