T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:23
- Finding
- Credential Inventory Commands May Expose Plaintext Secrets## Vulnerability Details **File Location**: `SKILL.md`, lines 23–31 **Vulnerability Type**: Plaintext sensitive-data disclosure **Risk Level**: High ```bash # Find hardcoded secrets (should be 0) rg -i "(api_key|apikey|secret_key|access_key|private_key|token)\s*[=:]\s*['\"][a-zA-Z0-9+/=_-]{16,}" \ --type-not binary -g '!node_modules' -g '!vendor' -g '!*.test.*' -g '!*.example*' 2>/dev/null # Find environment variable references for secrets rg -i "(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY|ACCESS_KEY|CLIENT_SECRET)" \ --type-not binary -g '!node_modules' -g '!vendor' 2>/dev/null | \ grep -v "test\|example\|mock\|fake\|dummy" | head -30 ``` ### Technical Analysis The inventory procedure uses `rg` to locate probable secrets but does not suppress or redact matching content. By default, `rg` prints the complete matching source line. If a configuration or source file contains a hardcoded API key, access token, password, private key, or client secret, the credential may consequently be copied into terminal output, the AI agent context, session transcripts, audit reports, or centralized execution logs. The first expression specifically seeks assignments containing secret-like values of at least 16 characters, making disclosure of actual credential material particularly likely when a match is found. The second expression is broader and may print configuration lines containing both a sensitive variable name and its value. Excluding some test and example files does not provide redaction and may also miss differently named fixtures. This finding is limited to local disclosure: the reviewed file contains no command that explicitly transmits discovered values to an external system. ### Attack Path 1. A user invokes the documented `inventory` workflow against a repository containing a plaintext credential. 2. The agent or operator executes one of the supplied recursive `rg` commands. 3. `rg` locates a matching assignment an ...[truncated 1059 chars]
- Remediation
- ## Remediation Suggestions 1. Replace content-printing searches with metadata-only output containing the file path, line number, and detected secret type. Do not include the matching line or value. 2. Use a purpose-built secret scanner with verified redaction support, such as Gitleaks with redaction enabled or `detect-secrets`, and validate that no raw value appears in stdout, stderr, reports, or debug logs. 3. Require explicit user authorization before scanning a repository and constrain every scan to the intended project root. 4. Treat all discovered values as sensitive. Do not place them in prompts, reports, persistent memory, issue trackers, chat messages, or telemetry. 5. Store findings using fingerprints or one-way hashes where correlation is necessary. Never record complete secrets. 6. Restrict access to scan logs and configure short retention periods. Disable command tracing and other verbose logging while secret discovery is running. 7. If a secret has already appeared in output, rotate or revoke it promptly, inspect access logs for misuse, and remove it from source history and retained transcripts where feasible. 8. Add a documented output-safety test using synthetic credentials to ensure future versions reveal only redacted findings.