T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/airbnb_property_listings_scraper_api.py:102
- Finding
- API Credential May Be Solicited Through the Agent Conversation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/airbnb_property_listings_scraper_api.py:102-108` **Additional Location**: `SKILL.md:27-30` **Vulnerability Type**: Credential exposure through insecure secret provisioning guidance **Risk Level**: Medium ### Vulnerable Code ```python api_key = os.getenv("BROWSERACT_API_KEY") if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print(f"1. Go to: {API_KEY_URL}", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) sys.exit(1) ``` The corresponding Skill instructions state: ```markdown Before running, check the `BROWSERACT_API_KEY` environment variable. If not set, do not take other measures; ask and wait for the user to provide it. **Agent must inform the user**: > "Since you haven't configured the BrowserAct API Key yet, please go to the [BrowserAct Console](https://www.browseract.com/reception/integrations?co-from=airbnb-property-listings-scraper) to get your Key." ``` ### Technical Analysis The Skill explicitly permits the user to provide a BrowserAct API key directly to the Agent. Secrets entered into an Agent conversation can become part of model context, conversation transcripts, platform logs, monitoring systems, or tool history. These channels should not be treated as secure secret-storage or secret-provisioning mechanisms. The script itself correctly obtains the key from the `BROWSERACT_API_KEY` environment variable and does not print its value. It also sends the key only as a Bearer token to the declared HTTPS BrowserAct API. The vulnerability is therefore the fallback guidance encouraging conversational disclosure, rather than the required authenticated network request. ### Attack Path 1. The user invokes the Skill without configuring `BROWSERACT_API_KEY`. 2. The script exits and ...[truncated 1386 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all instructions suggesting that users paste or otherwise provide API keys to the Agent. 2. Change the script message to require secure local configuration, for example: ```python print( "Set BROWSERACT_API_KEY in a protected local environment or secret manager, " "then run the command again. Do not paste the key into chat.", flush=True, ) ``` 3. Revise `SKILL.md` so the Agent directs users to configure the environment variable themselves and explicitly warns them not to disclose the key in conversation. 4. Recommend a secret manager, protected runtime secret injection, or a local environment file excluded from version control. 5. Ensure logs, exceptions, and diagnostics never include authorization headers or raw API credentials. 6. If a key has already been entered into a conversation, advise the user to revoke and rotate it immediately and review account usage for unauthorized activity. 7. Apply least privilege to the BrowserAct credential where the service supports scoped keys, usage limits, expiration, or task restrictions. ]]>