T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/google_social_media_finder_api.py:95
- Finding
- API Key Solicitation Through the Agent Conversation## Vulnerability Details **File Location**: `scripts/google_social_media_finder_api.py:95-99` and `SKILL.md:23-27` **Vulnerability Type**: Credential exposure through insecure secret-handling guidance **Risk Level**: Medium ### Vulnerable Code and Instructions `scripts/google_social_media_finder_api.py:95-99`: ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print(f"1. Go to: {API_KEY_URL}", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) ``` `SKILL.md:23-27`: ```markdown ## API Key Guide Before running, check the `BROWSERACT_API_KEY` environment variable. If it is not set, do not take other measures; ask and wait for the user to provide it. Agent must tell the user: > "Since you haven't configured the BrowserAct API Key yet, please go to the [BrowserAct Console](https://www.browseract.com/reception/integrations?co-from=google-social-media-finder) to get your Key." ``` ### Technical Analysis The Skill correctly supports loading the BrowserAct credential from the `BROWSERACT_API_KEY` environment variable. However, both its operational instructions and executable error message also encourage the user to provide the credential directly to the Agent. API keys are bearer credentials and should not be entered into ordinary conversational channels. Depending on the hosting environment, conversation content can be retained in chat history, Agent execution traces, diagnostic logs, telemetry, backups, or support records. This creates unnecessary credential exposure because the declared functionality only requires the key to be available to the local process; the Agent does not need to receive or retain its plaintext value. The outbound use of the key itself is consistent with the declared functionality ...[truncated 1811 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the option to provide the API key to the Agent or through chat. Replace the vulnerable message with guidance such as: ```python print( "Set BROWSERACT_API_KEY securely in the local execution environment. " "Do not paste the key into chat.", flush=True, ) ``` 2. Revise `SKILL.md` so that it requires local environment or secret-manager configuration and explicitly prohibits requesting, displaying, or storing the plaintext key in conversation content. 3. Prefer a platform-provided secrets facility when available. Inject the secret into the process environment only for the duration of execution and limit access to the process that needs it. 4. Ensure logs and exceptions never include the `Authorization` header or environment-variable value. Apply secret redaction to Agent traces and diagnostic output as defense in depth. 5. Document key rotation and revocation procedures. Any credential previously pasted into a conversation should be treated as exposed and replaced. 6. Where supported by BrowserAct, use narrowly scoped credentials, account-level spending or quota limits, expiration, and monitoring for anomalous API activity.