T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:27
- Finding
- API Key Solicitation Through Agent Conversation< to get your Key." ``` `scripts/amazon_product_reviews_scraper_api.py:105-109`: ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print(f"1. Go to: {API_KEY_URL}", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) ``` ### Technical Analysis The Skill instructs the Agent to ask the user to provide a reusable BrowserAct API key, and the script explicitly presents giving the key to the Agent as a supported configuration method. Supplying secrets through an Agent conversation can expose them to conversation history, application telemetry, model-provider infrastructure, debugging records, downstream Agent context, or other systems that process prompts. This disclosure is unnecessary because the implementation already reads the credential from the `BROWSERACT_API_KEY` environment variable. The script legitimately transmits that credential as a Bearer token only to the fixed BrowserAct HTTPS API endpoint. That network transmission is required for the declared functionality; collecting the same key through the conversation is not. No hardcoded credential was found ...[truncated 1541 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to ask users to provide API keys through the Agent conversation. 2. Replace the relevant `SKILL.md` guidance with instructions to configure the secret locally through an environment variable or supported secret manager. 3. Change the script message so it never suggests providing the key to the Agent. For example: ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print(f"Obtain a key from: {API_KEY_URL}", flush=True) print( "Configure it locally as BROWSERACT_API_KEY using your environment " "or an approved secret manager. Do not paste the key into chat.", flush=True, ) sys.exit(1) ``` 4. In `SKILL.md`, state explicitly that the Agent must not request, repeat, print, store, or accept the key in conversation. 5. Keep the credential limited to the child process environment for the duration of execution and avoid command-line arguments, files, diagnostic output, or exception messages that could disclose it. 6. Recommend revocation and rotation if a key has already been pasted into a conversation. 7. Where BrowserAct supports it, use a narrowly scoped credential with task, spending, rate, and expiration limits to reduce the impact of compromise. ]]>