T09 · Insecure Skill Coding Practices
- Location
scraper.js:15- Finding
Hardcoded AgResource Account Credentials in Scraper
- Content
View full analysis
Vulnerability Details
File Location:
scraper.js:15-16
Vulnerability Type: Hardcoded credentials and insecure secret management
Risk Level: HighVulnerable Code
js const AGRESOURCE_EMAIL = process.env.AGRESOURCE_EMAIL || 'brianppetty@yahoo.com'; const AGRESOURCE_PASSWORD = process.env.AGRESOURCE_PASSWORD || '4BrynnElizabeth';The embedded credentials are later entered into the AgResource login form at
scraper.js:123-129:js const emailField = await page.locator('input[type="email"], input[name="email"], #email').first(); await emailField.fill(AGRESOURCE_EMAIL); await page.waitForTimeout(500); // Find and fill password field const passwordField = await page.locator('input[type="password"], input[name="password"], #password').first(); await passwordField.fill(AGRESOURCE_PASSWORD);Technical Analysis
The scraper uses environment variables when available but silently falls back to a plaintext account email and password embedded in source code. Consequently, anyone with read access to the source package, repository history, backups, build artifacts, or distributed Skill archive can recover the credentials without executing the code.
This implementation contradicts the environment-only credential handling described in
SKILL.md. The fallback also causes the scraper to authenticate as the embedded account whenever the expected environment variables are absent, which can lead to unintended account use in copied or redistributed deployments.The hardcoded values must be treated as compromised because removing them from the current files does not remove them from existing archives or version-control history.
Attack Path
- An attacker obtains read access to the Skill package, source repository, build artifact, backup, or source mirror.
- The attacker opens
scraper.jsand extracts the plaintext email address and password from lines 15-16. - The attacker submits those credentials directly to the AgResource authent ...[truncated 1019 chars]
- Remediation
View remediation
Remediation Suggestions
- Immediately rotate the exposed password and invalidate all active sessions associated with the account.
- Remove all plaintext fallback credentials and require secret injection:
js const AGRESOURCE_EMAIL = process.env.AGRESOURCE_EMAIL; const AGRESOURCE_PASSWORD = process.env.AGRESOURCE_PASSWORD; if (!AGRESOURCE_EMAIL || !AGRESOURCE_PASSWORD) { throw new Error( 'AGRESOURCE_EMAIL and AGRESOURCE_PASSWORD environment variables are required' ); }- Store credentials in a managed secret service or inject them through protected runtime environment variables.
- Remove the credentials from version-control history, release archives, backups, mirrors, and previously distributed Skill packages where feasible.
- Add automated secret scanning to pre-commit, CI, and release workflows.
- Use a dedicated least-privilege service account if the external platform supports one.
- Ensure error messages and diagnostic logs never print credential values.
- Consider enabling multi-factor authentication and monitoring the account for unauthorized access.