T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:20
- Finding
- API Key Disclosure Encouraged Through Agent Conversation< to get your Key." ``` `scripts/amazon_product_search_scraper_api.py:106-113`: ```python api_key = os.getenv("BROWSERACT_API_KEY") if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print(f"1. Go to: {API_KEY_URL}", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) sys.exit(1) ``` ### Technical Analysis The Skill instructions explicitly direct the Agent to ask the user to provide the BrowserAct API key, and the script reinforces this by presenting disclosure to the Agent as an acceptable setup method. API keys are bearer credentials and should not be entered into an AI conversation. A key disclosed through chat may be retained in conversation history, Agent state, telemetry, model-provider logs, debugging records, or exported transcripts. This exposure is unnecessary because the implementation already supports secure environment-based credential injection through `BROWSERACT_API_KEY`. The script's direct network use of the key is otherwise consistent with the declared functionality: it sends the bearer credential over HTTPS only to the declared BrowserAct API endpoint at `api.br ...[truncated 1457 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove every instruction that asks users to provide or paste the API key into the Agent conversation. 2. Replace the affected instruction with guidance to configure the key locally through a protected environment variable or approved secret manager. 3. Change the script message to state only that `BROWSERACT_API_KEY` must be configured securely before invocation. For example: ```python if not api_key: print( "Error: BROWSERACT_API_KEY is not configured. " "Set it locally using a secure environment or secret manager; " "do not paste the key into chat.", flush=True, ) sys.exit(1) ``` 4. Update `SKILL.md` to require the Agent to report only whether the credential is configured, without requesting, displaying, repeating, or storing its value. 5. Avoid including secrets in command-line arguments because they may appear in process listings and shell history. 6. Ensure logs and error messages never print authorization headers or API-key values. 7. Recommend immediate revocation and rotation if a user has already disclosed a key in conversation. 8. Where supported, use narrowly scoped, short-lived credentials and account-level quota or billing alerts to reduce the impact of accidental disclosure. ]]>