T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/google_news_full_article_monitor_api.py:91
- Finding
- API Credential Solicitation Through Agent Conversation## Vulnerability Details **File Location**: `SKILL.md:29-33`; `scripts/google_news_full_article_monitor_api.py:91-97` **Vulnerability Type**: Sensitive credential exposure through insecure onboarding instructions **Risk Level**: Medium ### Vulnerable Code `SKILL.md:29-33`: ```markdown Before running, check the `BROWSERACT_API_KEY` environment variable. If it is not set, do not take other measures; ask and wait for the user to provide it. Agent must tell the user: > "Since you haven't configured the BrowserAct API Key yet, please go to the [BrowserAct Console](https://www.browseract.com/reception/integrations?co-from=google-news-full-article-monitor) to get your Key." ``` `scripts/google_news_full_article_monitor_api.py:91-97`: ```python api_key = os.getenv("BROWSERACT_API_KEY") if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print(f"1. Go to: {API_KEY_URL}", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) sys.exit(1) ``` ### Technical Analysis The Skill explicitly instructs the Agent to ask the user to provide a reusable BrowserAct API key when the environment variable is absent. The executable script reinforces this by presenting disclosure to the Agent as an alternative to local environment-variable configuration. API credentials should not be transmitted through conversational interfaces. A key pasted into a conversation may be retained in chat history, agent traces, platform telemetry, debugging records, or other logs. This disclosure is unnecessary because the script already supports reading the credential from the `BROWSERACT_API_KEY` environment variable. The script otherwise sends the Bearer credential only to the declared HTTPS endpoint at `https://api.browseract.com/v3/bots`, which ...[truncated 1565 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all instructions that ask users to provide API keys to the Agent or paste them into a conversation. 2. Replace the vulnerable script message with instructions to configure the secret locally: ```python print( "Set BROWSERACT_API_KEY securely in the local execution environment " "or approved secret manager, then run the command again.", flush=True, ) ``` 3. Update `SKILL.md` to state that the Agent must never request, receive, repeat, or store the API key. It should ask the user only to confirm after local configuration is complete. 4. Prefer an approved secret manager or protected runtime secret injection over shell history, command-line arguments, configuration files, or chat messages. 5. Ensure application logs and exception handlers never print the `Authorization` header or credential value. 6. If a key has already been shared in a conversation, revoke and rotate it immediately, then remove the exposed value from accessible histories and logs where supported. 7. Apply least privilege to BrowserAct credentials, including account scoping, quota controls, expiration, and periodic rotation where the service supports them.