T09 · Insecure Skill Coding Practices
- Location
config.md:22- Finding
Hardcoded Jenkins Administrator Credentials
- Content
View full analysis
Vulnerability Details
File Locations:
SKILL.md:56-57config.md:22-24
Vulnerability Type: Hardcoded administrative credentials and plaintext secret exposure
Risk Level: HighVulnerable Code
SKILL.md:56-57:markdown - Jenkins 地址：`http://localhost:8080` - 默认账号密码：`admin/admin`（如需要 API 方式）config.md:22-24:markdown - **地址**: http://localhost:8080 - **账号**: admin - **密码**: adminTechnical Analysis
The Skill package publishes a fixed Jenkins administrator username and password in plaintext. Anyone who can read the distributed package learns credentials that may provide administrative access to the Jenkins instance.
Binding Jenkins to
localhostreduces direct network exposure but does not provide an adequate security boundary. The endpoint may remain accessible to other local users, compromised processes, containers sharing the host network, malicious browser contexts, or remote users through port forwarding and proxy configuration. The risk would increase further if Jenkins were later bound to another interface without changing the documented credentials.Jenkins administrators can ordinarily manage jobs, credentials, plugins, nodes, and build configuration. Depending on the Jenkins deployment and agent permissions, control over build definitions can provide an indirect command-execution path on the controller or connected build agents.
Attack Path
- An attacker obtains or reads the Skill package and extracts the documented
admin/admincredentials. - The attacker gains access to
http://localhost:8080, such as through local execution, a compromised process, a shared container network, port forwarding, or an exposed proxy. - The attacker authenticates to Jenkins using the hardcoded credentials.
- If the default credentials remain active, the attacker accesses administrative Jenkins functions.
- The attacker triggers or modifies jobs, accesses b ...[truncated 1086 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the username and password from
SKILL.md,config.md, repository history, packaged releases, examples, and generated artifacts. - Immediately disable or rotate the exposed
admin/admincredentials; do not assume that deleting the documentation invalidates an already disclosed password. - Create a dedicated Jenkins service identity that can only trigger the explicitly approved
workeranduserjobs and inspect their queue or build status. - Deny that identity permissions to administer Jenkins, modify jobs, manage credentials, install plugins, configure nodes, or execute unrelated builds.
- Retrieve credentials at runtime from an approved secret manager or protected environment injection mechanism. Do not store secrets in Skill files or command-line arguments.
- Prefer scoped Jenkins API tokens over reusable account passwords, and configure expiration and periodic rotation where supported.
- Require explicit secure configuration when credentials are unavailable rather than falling back to a documented default.
- Restrict Jenkins network access using host firewall rules, authenticated reverse-proxy controls, or a dedicated private interface. Avoid relying solely on a localhost URL.
- Review Jenkins authentication and authorization logs for use of the exposed account and investigate unauthorized job or configuration changes.
- Add secret scanning to development and release pipelines to prevent credentials from being republished.
- Remove the username and password from