T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:20
- Finding
- API Key Solicitation Through Agent Conversation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20`; `scripts/bbb_lead_scraper_api.py:95-102` **Vulnerability Type**: Plaintext credential solicitation and insecure secret handling **Risk Level**: Medium ### Vulnerable Code `SKILL.md:20`: ```markdown Before running, check the `BROWSERACT_API_KEY` environment variable. If it is not set, do not take other measures; ask and wait for the user to provide it. ``` `scripts/bbb_lead_scraper_api.py:95-102`: ```python api_key = os.getenv("BROWSERACT_API_KEY") if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print(f"1. Go to: {API_KEY_URL}", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) sys.exit(1) ``` ### Technical Analysis The Skill explicitly instructs the Agent to ask the user for a BrowserAct API key and the script tells the user to “Provide it to me.” This encourages disclosure of an authentication credential through the conversational interface. A secret pasted into a conversation may be retained in chat history, Agent context, telemetry, tool logs, or other records accessible to systems that process the conversation. The disclosure is unnecessary because the script already supports reading the credential from the `BROWSERACT_API_KEY` environment variable. The actual network use of the credential is consistent with the declared functionality: the script transmits it as a Bearer token only to the HTTPS BrowserAct API. The vulnerability is therefore the unnecessary conversational solicitation of the secret, not the authenticated API request itself. ### Attack Path 1. The user invokes the Skill without configuring `BROWSERACT_API_KEY`. 2. The Skill follows `SKILL.md` and asks the user to provide the key, or the script prints the instruction to “Provide it to me.” 3. The user pastes t ...[truncated 1200 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to ask the user to provide the API key: ```markdown Before running, check the `BROWSERACT_API_KEY` environment variable. If it is not set, instruct the user to configure it securely in the local environment or approved secret manager. Never ask the user to paste the key into the conversation. ``` 2. Replace the script’s disclosure prompt with environment-only guidance: ```python if not api_key: print("[!] ERROR: BROWSERACT_API_KEY is not configured.", flush=True) print( "Configure it through your local environment or approved secret manager. " "Do not paste API keys into chat.", flush=True, ) sys.exit(1) ``` 3. Prefer an approved secret manager or protected runtime environment injection over command-line arguments, configuration files, or chat messages. 4. Ensure the API key is never printed in logs, exception messages, task output, or diagnostic telemetry. 5. Document credential rotation procedures and advise users who previously pasted a key into chat to revoke and replace it. 6. Where supported, use a narrowly scoped BrowserAct key with quota controls and only the permissions required to run and retrieve this template’s tasks. ]]>