T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_daily_check.sh:65- Finding
Daily report artifacts expose plaintext API credentials
- Content
View full analysis
summary.json provider.json smoke.json lt-detect.json b3it-detect.json ``` ### Technical Analysis The daily wrapper copies the complete provider configuration into each dated run directory. Provider configuration files are required to contain an `api_key`, so the copied `provider.json` contains the credential in plaintext. The same directory contains an HTML report that explicitly links to `provider.json`. As a result, a report directory intended for review or archival also becomes a credential-bearing directory. No sanitization, removal of the `api_key` field, restrictive permission assignment, or separation between secret configuration and publishable output is performed. This is particularly dangerous when daily report directories are: - Published through a static web server. - Uploaded as CI/CD artifacts. - Archived to shared storage. - Sent to other users for troubleshooting. - Readable by other local accounts due to default filesystem permissions. ### Attack Path 1. An operator creates a provider configuration containing a valid API key. 2. The operator runs the documented daily workflow: ```bash bash scripts/run_daily_check.sh ./provider.json ./daily-out my-endpoint ``` 3. The script copies the complete source configuration to: ```text daily-out/my-endpoint/runs/YYYY-MM-DD/provider.json ``` 4. The script creates `index.html` in the same directory and adds a dir ...[truncated 925 chars]- Remediation
View remediation