T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:20
- Finding
- BrowserAct API Key Is Solicited Through the Agent Conversation## Vulnerability Details **File Location**: `SKILL.md:20` and `scripts/google_trends_interest_scraper_api.py:95-102` **Vulnerability Type**: Insecure bearer-credential handling **Risk Level**: Medium ### Vulnerable Code `SKILL.md:20`: ```markdown Before running, check the `BROWSERACT_API_KEY` environment variable. If it is not set, do not take other measures; ask and wait for the user to provide it. ``` `scripts/google_trends_interest_scraper_api.py:95-102`: ```python api_key = os.getenv("BROWSERACT_API_KEY") if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print(f"1. Go to: {API_KEY_URL}", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) sys.exit(1) ``` ### Technical Analysis `BROWSERACT_API_KEY` is used as a bearer credential in the HTTP `Authorization` header. Although reading it from an environment variable is appropriate, both the Skill instructions and the script tell the user to provide the credential to the Agent as an alternative. Pasting a bearer token into an Agent conversation unnecessarily exposes it to conversation history, model context, diagnostic logs, integrations, and other systems with access to the session. Possession of a bearer token is generally sufficient for authentication within the permissions granted to that token; no additional proof of identity is demonstrated by this implementation. This behavior exceeds the minimum privileges and data exposure required for the declared functionality. The script can operate entirely by reading `BROWSERACT_API_KEY` from the local environment and therefore does not need the credential to enter the conversation. The script otherwise transmits the key only to the declared HTTPS BrowserAct endpoint. No evidence was found that it deliberate ...[truncated 1505 chars]
- Remediation
- ## Remediation Suggestions 1. Remove every instruction asking the user to provide or paste the API key into the Agent conversation. 2. Change `SKILL.md:20` to require secure local configuration, for example: ```markdown If `BROWSERACT_API_KEY` is not set, stop and instruct the user to configure it locally through an environment variable or approved secret manager. Never ask the user to paste the key into chat. ``` 3. Replace the script message with a local-only instruction: ```python print( "Set BROWSERACT_API_KEY locally using an environment variable or " "approved secret manager. Do not paste the key into chat.", flush=True, ) ``` 4. Prefer a platform-provided secret store over interactive input, command-line arguments, or plaintext configuration files. 5. Ensure the credential is never printed, included in exceptions, persisted in task output, or recorded by debug-level HTTP logging. 6. Document credential rotation and revocation procedures in case a key has already been shared through a conversation. 7. Where BrowserAct supports it, use a narrowly scoped token with minimum permissions and enforce expiration, usage monitoring, and quota limits.