T09 · Insecure Skill Coding Practices
- Location
scripts/query_valuation.py:22- Finding
Hardcoded Shared API Authentication Token
- Content
View full analysis
Vulnerability Details
File Location:
scripts/query_valuation.py, lines 22–26
Vulnerability Type: Hardcoded reusable credential
Risk Level: MediumVulnerable Code
python # Prefer the environment variable, but fall back to an embedded public token AUTH_TOKEN = os.environ.get( "STOCK_VALUATION_AUTH", "b0a590b5-6371-4665-b041-0b97cc553f6d" )The token is subsequently sent in the authentication header at lines 121–125:
python headers = { "Content-Type": "application/json", "v": API_VERSION, "auth": AUTH_TOKEN, }Technical Analysis
A reusable API authentication token is embedded directly in the distributed source code. When
STOCK_VALUATION_AUTHis absent, the application silently authenticates requests with this shared token.Because source packages are available to every Skill user, the credential cannot be treated as secret. An attacker does not need to execute the Skill or compromise its runtime environment; reading the source is sufficient to recover the token. The documented API endpoint and authentication header format also make direct reuse straightforward.
The documentation explicitly confirms that the fallback is intentional in
SKILL.md, lines 84–86. Describing it as a public token does not eliminate the security risk if it authorizes API operations, consumes a shared quota, or identifies requests as originating from a trusted shared principal.Attack Path
- Download or inspect the Skill package.
- Open
scripts/query_valuation.py. - Extract the hardcoded fallback token.
- Obtain the API endpoint from the same script or
references/api_fields.md. - Send direct POST requests to the endpoint with the recovered value in the
authheader. - Consume the shared quota, automate bulk requests, or otherwise abuse access granted to the shared API identity until the token is revoked or rate-limited.
Impact Assessment
The attacker gains the API access and quota associated with th ...[truncated 539 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the hardcoded fallback token from the source code.
- Require
STOCK_VALUATION_AUTHto be supplied through a secure runtime secret mechanism. - Fail safely with a clear configuration error when the environment variable is absent.
- Revoke and rotate the exposed token because it must be considered compromised after distribution.
- Issue separate, scoped credentials per user or installation rather than sharing one identity.
- Apply server-side least privilege, request quotas, rate limits, expiration, and credential revocation controls.
- Prevent credentials from entering source control by using secret scanning and pre-commit or CI checks.
- Avoid printing authentication values in errors or logs.
A safer configuration pattern is:
python AUTH_TOKEN = os.environ.get("STOCK_VALUATION_AUTH") if not AUTH_TOKEN: raise RuntimeError( "STOCK_VALUATION_AUTH must be configured before querying the API" )