T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:30
- Finding
- Insecure Solicitation of BrowserAct API Credentials Through Agent Conversation< to get your Key." ``` `scripts/airbnb_property_reviews_scraper_api.py:104-108`: ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print(f"1. Go to: {API_KEY_URL}", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) ``` ### Technical Analysis The Skill explicitly instructs the Agent to ask the user for a reusable BrowserAct API key and tells the user that they may “provide it to me.” This encourages disclosure of authentication material through the conversational interface. The script itself only requires access to the `BROWSERACT_API_KEY` environment variable. Therefore, transmitting the key through the Agent conversation is not necessary for the declared scraping functionality and exceeds the minimum information exposure needed to operate the Skill. Credentials entered into a conversation may be retained in chat history, application logs, Agent traces, telemetry, or connected services. Although the implementation does not print the configured API key and sends its Bearer token only to the documented HTTPS BrowserAct endpoint, the credential-collection guidance creates an avoid ...[truncated 1475 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to ask the user to provide the API key through the conversation. 2. Change the missing-key guidance to require secure local configuration, for example: ```markdown Set `BROWSERACT_API_KEY` through your runtime's secret manager or environment-variable configuration. Do not paste API keys into chat. ``` 3. Update the script message so it never suggests disclosing the key to the Agent: ```python print( "3. Configure BROWSERACT_API_KEY securely in your local environment " "or runtime secret manager. Do not paste the key into chat.", flush=True, ) ``` 4. Prefer a dedicated secret-management facility over shell history or plaintext configuration files. 5. Ensure chat logs, Agent traces, and telemetry apply secret redaction for patterns resembling API credentials. 6. If a key has already been disclosed through a conversation, revoke and rotate it immediately, then review BrowserAct task and billing history for unauthorized activity. 7. Where supported, use narrowly scoped, short-lived credentials and account spending or quota limits to reduce the impact of future exposure. ]]>