T09 · Insecure Skill Coding Practices
- Location
scripts/china_travel.py:23- Finding
Hard-Coded Proxy Authentication Token
- Content
View full analysis
Vulnerability Details
File Location:
scripts/china_travel.py, lines 23–24 and 28–40
Vulnerability Type: Hard-coded secret in distributed source code
Risk Level: MediumVulnerable Code
python PROXY_URL = "https://1439498936-eu423jdjnd.ap-guangzhou.tencentscf.com" PROXY_TOKEN = "tp_8k2mX9vQ4z" def query_tripgenie(query, locale="en", command_type="hotel"): """Query via SCF proxy (token injected server-side, affiliate links auto-injected).""" payload = {"query": query, "locale": locale, "command_type": command_type} data = json.dumps(payload).encode("utf-8") req = urllib.request.Request( PROXY_URL, data=data, headers={ "Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN, "User-Agent": "ChinaTravel/2.0", }, method="POST" )Technical Analysis
The source code embeds a reusable proxy authentication token and sends it in the
X-Proxy-Tokenheader with every request. Any person able to download or inspect the skill can recover this credential without executing the program.The skill manifest declares
PROXY_URLandPROXY_TOKENas environment-based configuration, but the implementation uses constants instead. This prevents secure per-deployment configuration and credential rotation. HTTPS protects the token while in transit but does not mitigate its disclosure in the distributed source code.The exact authorization granted by the token cannot be established from the reviewed files. Exploitation is therefore limited to whatever operations the remote proxy permits for this credential.
Attack Path
- An attacker downloads or otherwise obtains the published skill package.
- The attacker opens
scripts/china_travel.pyand extractsPROXY_URLandPROXY_TOKEN. - The attacker constructs an HTTPS
POSTrequest to the exposed proxy endpoint. - The attacker supplies the recovered value in the
X-Proxy-Tokenheader and submits ...[truncated 864 chars]
- Remediation
View remediation
Remediation Suggestions
- Immediately revoke and rotate the exposed proxy token.
- Remove the token and endpoint constants from source control and published artifacts.
- Load configuration from the environment variables already declared by the skill:
python import os PROXY_URL = os.environ.get("PROXY_URL") PROXY_TOKEN = os.environ.get("PROXY_TOKEN") if not PROXY_URL or not PROXY_TOKEN: raise RuntimeError("PROXY_URL and PROXY_TOKEN must be configured")- Store the replacement credential in an approved secret manager and inject it only at runtime.
- Use short-lived, narrowly scoped credentials rather than one static shared token.
- Enforce server-side authorization, per-client quotas, rate limiting, request validation, monitoring, and credential-revocation controls. Do not treat possession of a publicly distributed client token as strong authentication.
- Review proxy logs for prior misuse of the exposed token while avoiding storage of sensitive user query content.
- Add automated secret scanning to source-control and release pipelines to prevent future credential publication.
- Ensure the rotated token is removed from repository history and cached release artifacts where feasible; history cleanup does not replace revocation.