T09 · Insecure Skill Coding Practices
Warning
- Location
- CONFIG.md:89
- Finding
- API Keys Exposed in Plaintext During Configuration Verification## Vulnerability Details **File Location**: `CONFIG.md`, lines 89–93 **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Medium ### Vulnerable Code ```bash # Check environment variables echo $QVERIS_API_KEY echo $TAVILY_API_KEY ``` ### Technical Analysis The documented verification procedure prints the complete values of two API keys to standard output. Although the keys are correctly sourced from environment variables rather than hardcoded, displaying their values defeats the confidentiality benefit of that storage mechanism. The secrets may subsequently appear in terminal scrollback, screen-sharing sessions, recordings, support transcripts, CI/CD logs, or other command-output collection systems. Verifying that a variable is configured does not require revealing its value. ### Attack Path 1. A user configures `QVERIS_API_KEY` and `TAVILY_API_KEY`. 2. The user follows the documented verification commands. 3. Both complete credentials are printed in the terminal. 4. An unauthorized party observes the terminal, recording, shared screen, or retained output log. 5. The party copies the exposed credentials and submits requests to the corresponding external services. This path requires access to the resulting terminal output; the documentation does not independently transmit the keys elsewhere. ### Impact Assessment An attacker who obtains the exposed credentials may authenticate to the Qveris or Tavily services with the permissions assigned to those keys. Potential consequences include unauthorized API usage, consumption of paid quotas, service disruption through quota exhaustion, and access to any data or operations permitted by the affected account. The issue does not provide local system privilege escalation or code execution by itself. Its scope is bounded by the permissions, rate limits, billing configuration, and lifetime of the exposed API keys.
- Remediation
- ## Remediation Suggestions Replace value-printing commands with presence-only checks: ```bash if [ -n "${QVERIS_API_KEY:-}" ]; then echo "QVERIS_API_KEY is set" else echo "QVERIS_API_KEY is missing" fi if [ -n "${TAVILY_API_KEY:-}" ]; then echo "TAVILY_API_KEY is set" else echo "TAVILY_API_KEY is missing" fi ``` Apply the following additional controls: 1. Never display full credentials in setup, diagnostic, or validation instructions. 2. If identification is necessary, display only a short, non-sensitive fingerprint rather than any reusable portion of a key. 3. Ensure CI/CD systems and terminal-recording tools redact recognized secret values. 4. Warn users not to paste keys or unredacted diagnostic output into issues, chat systems, or support requests. 5. Revoke and rotate any credential that has already appeared in logs, recordings, screenshots, or shared terminal output. 6. Retain the existing environment-variable configuration and use least-privilege, quota-limited API keys where supported.