T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:26
- Finding
- API Key Solicitation Through Conversational Context< to get your Key." ``` `scripts/ebay_product_details_scraper_api.py:97-101`: ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print(f"1. Go to: {API_KEY_URL}", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) ``` ### Technical Analysis The Skill explicitly instructs the Agent to ask the user for the BrowserAct API key, while the executable helper tells the user to “Provide it to me.” This encourages disclosure of a reusable secret through conversational input. Secrets pasted into a conversation may be retained in model context, conversation history, platform telemetry, debugging records, or other service logs. This expands exposure beyond the local process that needs the credential. Conversational disclosure is not necessary for the declared functionality because the implementation already supports reading the key from the `BROWSERACT_API_KEY` environment variable. The script legitimately sends the key as an HTTPS Bearer token only to the declared BrowserAct API. The relevant network operation is: ```python headers = {"Authorization": f"Bearer {api_key}"} response = requests.post( ...[truncated 1943 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all instructions asking users to provide or paste API keys into the conversation. 2. Replace the affected instruction in `SKILL.md` with guidance that requires local secret configuration, for example: ```markdown If `BROWSERACT_API_KEY` is not configured, stop and instruct the user to set it locally through a protected environment variable or secret manager. Never ask the user to paste the key into chat. ``` 3. Replace the script's prompt with non-conversational configuration guidance: ```python if not api_key: print("[!] ERROR: BROWSERACT_API_KEY is not configured.", flush=True) print( "Set it locally using a protected environment variable or secret manager. " "Do not paste API keys into chat or command-line arguments.", flush=True, ) sys.exit(1) ``` 4. Recommend a platform-provided secret store where available, with the key injected into the process environment only when the Skill executes. 5. Do not accept the key through command-line arguments because process listings and shell history can expose it. 6. Ensure application, proxy, telemetry, and exception logs never record authorization headers or environment-variable values. 7. Use a narrowly scoped BrowserAct credential if the service supports scoped keys, and rotate any key previously disclosed through a conversation. 8. Document revocation and rotation procedures so users can promptly invalidate potentially exposed credentials. ]]>