T09 · Insecure Skill Coding Practices
- Location
scripts/powerlego_api.py:13- Finding
Hard-Coded Bearer Token in Distributed Source Code
- Content
View full analysis
Vulnerability Details
File Location:
scripts/powerlego_api.py, lines 13–18
Vulnerability Type: Hard-coded authentication credential
Risk Level: Mediumpython API_TOKEN = "Bearer 679b742f444ac4121368dfd32e504119" DEFAULT_HEADERS = { "Accept": "*/*", "Authorization": API_TOKEN, "Origin": "https://www.personalized.energy", "Referer": "https://www.personalized.energy/", }Technical Analysis
A reusable bearer token is embedded directly in the distributed Skill source. Anyone with access to the package can extract this credential without executing the Skill. The token is assigned to the
Authorizationheader and is automatically included in requests to the PowerLego endpoints.The implementation provides no runtime secret retrieval, credential rotation, per-user authorization, or separation between distributable client code and privileged service credentials. Any restrictions claimed through the
OriginandRefererheaders are not effective authentication controls because an independent client can reproduce those headers.The outbound requests serve the declared electricity-shopping workflow and use HTTPS. However, embedding the credential is unnecessary: privileged authentication should remain in an owner-controlled service or approved runtime secret store.
Attack Path
- Obtain or inspect the Skill package.
- Open
scripts/powerlego_api.py. - Copy the bearer token declared on line 13.
- Construct independent requests to the PowerLego endpoints listed in the same file.
- Include the copied token in the
Authorizationheader and reproduce the publicOriginandReferervalues if required. - Continue making requests within the token's permissions until the credential is revoked, expires, or is blocked.
Impact Assessment
An attacker may impersonate this integration and exercise whatever API privileges are granted to the exposed token. Depending on ...[truncated 637 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke and rotate the exposed token immediately, treating it as compromised.
- Remove the token from source code and repository history.
- Route authenticated requests through an owner-controlled backend so the credential is never distributed with the Skill.
- If direct runtime authentication is unavoidable, retrieve the credential from an approved secret manager rather than a committed file.
- Use short-lived, narrowly scoped credentials restricted to the necessary endpoints and operations.
- Apply server-side rate limits, usage monitoring, audience restrictions, and anomaly alerts.
- Do not rely on client-controlled
OriginorRefererheaders as authorization controls. - Ensure logs, exceptions, diagnostics, and generated outputs never disclose replacement credentials.
- Review service logs for unauthorized use of the exposed token and invalidate any related sessions or derivative credentials.