T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:23
- Finding
- API Key Requested Through Agent Conversation## Vulnerability Details **File Location**: `SKILL.md:23-27` and `scripts/google_news_scraper_api.py:96-100` **Vulnerability Type**: Credential exposure through insecure secret onboarding **Risk Level**: Medium ### Complete Vulnerable Code Snippets `SKILL.md:23-27`: ```markdown ## API Key Guide Before running, check the `BROWSERACT_API_KEY` environment variable. If it is not set, do not take other measures; ask and wait for the user to provide it. Agent must tell the user: > "Since you haven't configured the BrowserAct API Key yet, please go to the [BrowserAct Console](https://www.browseract.com/reception/integrations?co-from=google-news-scraper) to get your Key." ``` `scripts/google_news_scraper_api.py:96-100`: ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print(f"1. Go to: {API_KEY_URL}", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) ``` ### Technical Analysis The Skill directs the Agent to ask the user for a BrowserAct API key and wait for the user to provide it. The executable script reinforces this behavior by telling the user to “Provide it to me.” This creates an insecure credential-handling path because a user may paste the secret into the conversation. The API key could then be retained in chat transcripts, Agent context, telemetry, debugging records, platform logs, or other orchestration components. Such exposure is unnecessary: the script already supports reading the credential directly from the `BROWSERACT_API_KEY` environment variable. The outbound use of the credential itself is functionally justified. The script sends it as an HTTPS Bearer token only to the declared BrowserAct API for task creation, status polling, and result retrieval. The vulnerability is the conversational collection of the credential, which exceeds ...[truncated 1413 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction to ask users to provide the API key to the Agent. 2. Replace it with a requirement that users configure `BROWSERACT_API_KEY` locally through an environment variable or approved secret manager. 3. Revise the script message so it never suggests pasting credentials into chat. For example: ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print(f"Obtain a key from: {API_KEY_URL}", flush=True) print( "Configure it securely as BROWSERACT_API_KEY in your local environment " "or approved secret manager. Do not paste the key into chat.", flush=True, ) sys.exit(1) ``` 4. Update `SKILL.md` to state explicitly that the Agent must not request, receive, echo, log, or persist the API key. 5. Use a platform-native secret injection mechanism when available so the credential is supplied directly to the process. 6. Redact authorization headers and likely API-key patterns from application logs, telemetry, exception reports, and command traces. 7. Grant the BrowserAct key only the permissions required for this template, apply usage limits where supported, and rotate any key previously disclosed through conversation.