T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:121- Finding
Credential Disclosure Through Chat-Based Token Configuration
- Content
View full analysis
MCP Access -> Create Token" Write-Host "" Write-Host "Configuration methods:" Write-Host " Method 1 (easiest): Tell the token directly to the AI assistant and let it write the token" Write-Host " Method 2: Open sysdm.cpl -> Advanced -> Environment Variables -> create WOLAI_MCP_TOKEN" Write-Host " Method 3: Run [System.Environment]::SetEnvironmentVariable('WOLAI_MCP_TOKEN','sk-xxx','User') in PowerShell" Write-Host "" Write-Host "Restart WorkBuddy after configuration" exit 1 } ``` The snippet above is an English rendering of the corresponding user-facing strings; the executable structure and security-relevant instruction are unchanged. ### Technical Analysis The credential precheck instructs users to submit their Wolai MCP bearer token directly to an AI assistant. Bearer tokens must be treated as secrets because possession is sufficient for authentication. Entering such a token into a conversation can expose it to conversation history, application logs, telemetry, model context, tool traces, debugging records, or anyone who can access the relevant session. This instruction also directly conflicts with the warning at `SKILL.md:38`, which tells users not to paste the token into chat. The contradictory guidance makes accidental disclosure more likely, especially because the unsafe method is described as the easiest option. The network transmission implemented elsewhere in the Skill is not itself an unrelated exfiltration mechanism: t ...[truncated 1811 chars]- Remediation
View remediation