T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:28
- Finding
- API Key Disclosure Through Agent Conversation< to get your Key." ``` `scripts/google_search_results_scraper_api.py:94-101`: ```python api_key = os.getenv("BROWSERACT_API_KEY") if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print(f"1. Go to: {API_KEY_URL}", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) sys.exit(1) ``` ### Technical Analysis The Skill instructions tell the Agent to ask for the BrowserAct API key and wait for the user to provide it. The executable script reinforces this behavior by explicitly offering “Provide it to me” as a credential configuration method. An API key is an authentication secret. Asking a user to paste it into an Agent conversation can expose it to conversation history, model context, Agent telemetry, execution transcripts, tool logs, or other systems that retain prompts and responses. This exposure is unnecessary because the script already supports retrieving the key from the `BROWSERACT_API_KEY` environment variable. The script legitimately transmits the key as a Bearer token only to the declared HTTPS endpoint at `api.browseract.com`. That network transmission is required for the Skill’s stated BrowserAct functio ...[truncated 1763 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to ask users to provide the API key to the Agent. 2. Replace the affected text with an explicit warning such as: ```text Set BROWSERACT_API_KEY securely in your local environment or approved secret manager. Do not paste the API key into chat. ``` 3. Change the script’s missing-key message so that it only recommends secure local configuration: ```python print( "Set BROWSERACT_API_KEY securely in your local environment. " "Do not provide the key through chat.", flush=True, ) ``` 4. Where supported, use the execution platform’s protected secret-storage mechanism rather than ordinary conversation input or command-line arguments. 5. Ensure the key is never included in logs, exception messages, task output, debugging traces, or process arguments. 6. Apply least privilege to the BrowserAct key, restrict its available capabilities where supported, and rotate any key previously pasted into an Agent conversation. 7. Document credential revocation and rotation procedures so users can respond promptly to accidental disclosure. ]]>