T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:30
- Finding
- Bearer API Key Solicited Through Agent Conversation## Vulnerability Details **File Location**: `SKILL.md:30-33` and `scripts/amazon_best_sellers_scraper_api.py:101-106` **Vulnerability Type**: Sensitive credential exposure through insecure instructions **Risk Level**: Medium **Affected code in `SKILL.md:30-33`:** ```markdown ## 🔑 API Key Guide Before running, check the `BROWSERACT_API_KEY` environment variable. If not set, do not take other measures; ask and wait for the user to provide it. **Agent must inform the user**: > "Since you haven't configured the BrowserAct API Key yet, please go to the [BrowserAct Console](https://www.browseract.com/reception/integrations?co-from=amazon-best-sellers-scraper) to get your Key." ``` **Affected code in `scripts/amazon_best_sellers_scraper_api.py:101-106`:** ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print(f"1. Go to: {API_KEY_URL}", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) ``` ### Technical Analysis `BROWSERACT_API_KEY` is a bearer credential used to authorize requests to the BrowserAct service. The Skill instructions direct the Agent to ask the user to provide this credential, while the script explicitly offers “Provide it to me” as a configuration method. Supplying a bearer credential through an Agent conversation can expose it to conversation history, application telemetry, execution traces, support records, or other systems that retain prompts and responses. This disclosure is unnecessary because the script already supports reading the key from the `BROWSERACT_API_KEY` environment variable. The actual network use of the credential is consistent with the declared functionality: it is placed in an authorization header and sent over HTTPS to the fixed BrowserAct API endpoint. No evidence was ...[truncated 1533 chars]
- Remediation
- ## Remediation Suggestions 1. Remove every instruction telling users to provide or paste the API key into the Agent conversation. 2. Replace the affected `SKILL.md` guidance with an instruction to configure the credential outside the conversation, such as: ```markdown If `BROWSERACT_API_KEY` is not configured, stop execution and ask the user to set it through the runtime's secret manager or local environment. Never ask the user to paste the key into chat. ``` 3. Replace the script message with: ```python print( "Configure BROWSERACT_API_KEY through your environment or secret manager. " "Do not paste the key into chat or command-line arguments.", flush=True, ) ``` 4. Prefer a platform-provided secret manager over persistent shell configuration where available. 5. Ensure the API key is never included in command-line arguments, status messages, exceptions, debug output, telemetry, or serialized results. 6. Redact authorization headers from HTTP and application logs. 7. Document a key-rotation procedure and advise users to revoke and replace any key previously disclosed in a conversation. 8. Where supported by BrowserAct, use a narrowly scoped credential with spending, task, and concurrency limits to reduce the effect of accidental disclosure.