T09 · Insecure Skill Coding Practices
- Location
scripts/china_travel.py:22- Finding
Hardcoded Proxy Authentication Token
- Content
View full analysis
Vulnerability Details
File Location:
scripts/china_travel.py, lines 22–23 and 31–36
Vulnerability Type: Hardcoded reusable authentication credential
Risk Level: HighVulnerable Code
python PROXY_URL = "https://1439498936-eu423jdjnd.ap-guangzhou.tencentscf.com" PROXY_TOKEN = "tp_8k2mX9vQ4z"python req = urllib.request.Request( PROXY_URL, data=data, headers={ "Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN, "User-Agent": "ChinaTravel/2.0", }, method="POST" )Technical Analysis
The source code embeds a reusable proxy authentication token and its associated endpoint. Anyone who can obtain the distributed skill package can extract the credential without executing the program.
The implementation also contradicts the environment-variable declarations in
SKILL.md: rather than loadingPROXY_URLandPROXY_TOKENfrom the runtime environment, it uses fixed constants. Consequently, deployment-level secret management cannot protect or rotate this credential independently of the package.An attacker can reproduce the request structure shown in the code and submit authenticated requests directly to the proxy. Whether access to downstream services is possible depends on server-side controls not present in the audited project, but the exposed token is sufficient to attempt unauthorized use of the proxy identity.
Attack Path
- Obtain or download the published skill package.
- Inspect
scripts/china_travel.py. - Extract the fixed proxy URL and the value assigned to
PROXY_TOKEN. - Construct an HTTPS
POSTrequest containing a JSON body withquery,locale, andcommand_type. - Set the extracted token in the
X-Proxy-Tokenheader. - Send requests directly to the proxy outside the intended skill workflow.
- Continue using the credential until it is rotated, revoked, or blocked by server-side con ...[truncated 715 chars]
- Remediation
View remediation
Remediation Suggestions
-
Immediately revoke and rotate the exposed token. Treat it as compromised because it was committed to distributable source code.
-
Remove the token and deployment-specific endpoint from source control.
-
Load configuration from the declared environment variables and fail closed when they are missing:
python import os PROXY_URL = os.environ.get("PROXY_URL") PROXY_TOKEN = os.environ.get("PROXY_TOKEN") if not PROXY_URL or not PROXY_TOKEN: raise RuntimeError("Required proxy configuration is missing") -
Provision secrets through an approved secret manager or protected runtime configuration rather than package metadata, command-line arguments, or plaintext files.
-
Prefer short-lived, narrowly scoped credentials. Restrict the token to only the required proxy operations and downstream resources.
-
Enforce server-side rate limits, request quotas, expiration, revocation, origin or workload identity checks, and abuse monitoring. A client-side secret distributed to users must not be considered confidential.
-
Review proxy access logs for unauthorized use of the exposed token and invalidate any related credentials if suspicious activity is found.
-
Add secret scanning to source-control and publication pipelines to prevent future releases containing tokens or API keys.
-
If the client is intentionally public, replace the shared static secret with an authentication design that does not rely on keeping credentials confidential in distributed code.
-