T09 · Insecure Skill Coding Practices
Warning
- Location
references/workflows.md:22- Finding
Owner Capability Token Disclosed by Default in Share-Creation Responses
- Content
View full analysis
Vulnerability Details
File Location:
references/workflows.md:22-35
Vulnerability Type: Capability-token exposure through insecure default output behavior
Risk Level: MediumVulnerable Code Snippet
text 4. Return: - public link - manage link - edit link only if `editorToken` exists 5. Briefly explain the difference between public and manage links. Suggested reply shape: ```text 分享已创建。 公开访问：https://share.yekyos.com/s/{slug} 管理链接：https://share.yekyos.com/e/{slug}#manage={ownerToken}text ### Technical Analysis The creation workflow directs the Agent to include the manage link, containing the `ownerToken`, in its default response. This conflicts with the security requirement in `SKILL.md:15-18`, which states that token-bearing links must not be exposed unless the user explicitly wants them. The owner token is a bearer capability rather than an informational identifier. According to the documented API, possession of it permits the holder to read and modify share content, change security settings, alter expiration and editability, and delete the share. No additional authentication is documented for these operations. Returning this token automatically expands exposure beyond the minimum privilege required to satisfy a basic request to publish Markdown. Chat histories, Agent traces, telemetry, screenshots, copied responses, or downstream integrations may retain the token. Although placing the token in a URL fragment generally prevents it from being sent as an HTTP request path, it does not protect it from disclosure through the Agent response itself, browser history, client-side scripts, or copied links. ### Attack Path 1. A user asks the Agent to create a temporary public Markdown share but does not explicitly request administrative access. 2. The Agent calls `POST /api/shares`, receiving the public slug and `ownerToken`. 3. Following the workflow, the Agent includes the tok ...[truncated 1044 chars]- Remediation
View remediation
Remediation Suggestions
- Return only the public share URL by default.
- Require an explicit user request before displaying any manage or edit link.
- Update the workflow and suggested response so they agree with the restriction in
SKILL.md:15-18. - Avoid placing bearer tokens in ordinary Agent messages when a secure secret-delivery mechanism is available.
- Clearly label manage and edit links as sensitive credentials and warn users not to forward, publish, or log them.
- Redact
ownerToken,editorToken,x-share-token, and token-bearing URLs from execution traces, telemetry, debugging output, and error messages. - Where service changes are possible, support token rotation and revocation so accidentally disclosed capabilities can be invalidated without recreating the share.
- Add a regression test confirming that a normal “create a public share” request returns only the public URL unless privileged links were explicitly requested.