T09 · Insecure Skill Coding Practices
- Location
scripts/china_travel.py:24- Finding
Hard-Coded Proxy Authentication Token
- Content
View full analysis
Vulnerability Details
File Location:
scripts/china_travel.py, lines 24–25 and 32–39
Vulnerability Type: Hard-coded authentication credential
Risk Level: HighVulnerable Code
python PROXY_URL = "https://1439498936-eu423jdjnd.ap-guangzhou.tencentscf.com" PROXY_TOKEN = "tp_8k2mX9vQ4z" def query_tripgenie(query, locale="en", command_type="hotel"): """Query via SCF proxy (token injected server-side, affiliate links auto-injected).""" payload = {"query": query, "locale": locale, "command_type": command_type} data = json.dumps(payload).encode("utf-8") req = urllib.request.Request( PROXY_URL, data=data, headers={ "Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN, "User-Agent": "ChinaTravel/2.0", }, method="POST" )Technical Analysis
The source code embeds a reusable proxy authentication token and the associated service URL directly in the distributed Python script. Anyone with access to the skill package can recover the credential without executing the program.
This contradicts the environment-variable declaration in
SKILL.md, which listsPROXY_URLandPROXY_TOKENas configuration values. Because the implementation never reads those variables, normal secret-management controls cannot protect or rotate the credential independently of the published package.The token is transmitted over HTTPS, which protects it in transit under normal TLS assumptions, but does not mitigate disclosure from source code. The audit did not test the external service or attempt to validate the token, so its current validity and exact server-side authorization scope are unknown.
Attack Path
- An attacker downloads or otherwise obtains the published skill package.
- The attacker inspects
scripts/china_travel.pyand extractsPROXY_URLandPROXY_TOKEN. - The attacker constructs POST requests to the disclosed proxy URL.
- The attacker p ...[truncated 1203 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke and rotate the exposed token immediately. Treat it as compromised because it has been distributed in source code.
- Remove both the token and environment-specific endpoint from the script:
python import os PROXY_URL = os.environ.get("PROXY_URL") PROXY_TOKEN = os.environ.get("PROXY_TOKEN") if not PROXY_URL or not PROXY_TOKEN: raise RuntimeError("PROXY_URL and PROXY_TOKEN must be configured") - Supply secrets through an approved runtime secret manager or protected environment injection mechanism. Do not commit real fallback credentials.
- Use short-lived, narrowly scoped credentials rather than a static shared token.
- Enforce server-side authorization by operation and validate
command_type, request size, query content, and supported locales. - Add per-token and per-source rate limits, quotas, anomaly detection, and abuse alerting.
- Ensure logs redact the
X-Proxy-Tokenheader and other authentication data. - Establish a credential-rotation process and invalidate credentials used by obsolete skill versions.
- Add automated secret scanning to source-control and release pipelines to prevent future embedded credentials.
- Update documentation so the declared environment-variable configuration matches the implementation.