T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:46- Finding
API Credential Embedded in TwiML Redirect URL
- Content
View full analysis
Connecting now. https://api.hume.ai/v0/evi/twilio?config_id={config_id}&api_key={api_key} ''' ``` ### Technical Analysis The example places the Hume API key directly in the query string of a redirect URL. Although sending credentials to the declared Hume service supports the Skill's intended voice-integration functionality, placing a reusable secret in a URL unnecessarily expands its exposure. URLs may be captured by application logs, Twilio or Hume request logs, reverse proxies, observability platforms, exception reports, debugging output, and tracing systems. Access controls and retention policies for these systems are frequently less restrictive than controls applied to dedicated secret stores. This is an insecure credential-handling pattern rather than evidence of intentional exfiltration. The destination is consistent with the Skill's declared functionality, but exposing a long-lived API key through a query parameter exceeds minimum safe privilege and data-exposure practices. ### Attack Path 1. A developer implements the documented TwiML redirect using a reusable Hume API key. 2. Twilio, an application proxy, or an observability component records the complete redirect URL. 3. An attacker or unauthorized operator gains read access to those logs, traces, or error reports. 4. The attacker extracts the `api_key` query parameter. 5. The attacker submits unauthorized requests to Hume endpoints accepted by that credential. 6. The credential remains usable until it expires or is explicitly revoked. ### Impact Assessment Successful exploitation may permit unauthorized consumption of the victim's Hume account resources and ...[truncated 456 chars]- Remediation
View remediation