T09 · Insecure Skill Coding Practices
Error
- Location
- references/jira.md:5
- Finding
- Plaintext Jira API Token Embedded Throughout the Skill Package<![CDATA[ ## Vulnerability Details **File Locations**: - `references/jira.md:5-8` - `scripts/add_comment.py:14-17` - `scripts/create_issue.py:25-28` - `scripts/find_repo.py:10-13` - `scripts/get_issue_description.py:8-11` - `scripts/get_issue_info.py:15-18` - `scripts/get_my_todo_issues.py:8-11` - `scripts/get_sprint_issues.py:20-23` - `scripts/transition_issue.py:18-21` - `scripts/update_issue.py:23-26` **Vulnerability Type**: Hardcoded authentication secret **Risk Level**: High ### Vulnerable Code The reference file stores the credential directly: ```markdown ## Jira Credentials (stored in session context) - JIRA_URL: `https://attrix-team.atlassian.net/` - JIRA_EMAIL: `xwang@attrix.ca` - JIRA_API_TOKEN: `[REDACTED EXPOSED JIRA API TOKEN]` ``` The same credential is duplicated as a fallback in the Jira scripts: ```python # --- Config (from Skill's references/jira.md) --- JIRA_URL = os.environ.get( "JIRA_BASE_URL", "https://attrix-team.atlassian.net/", ) JIRA_EMAIL = os.environ.get("JIRA_EMAIL", "xwang@attrix.ca") JIRA_API_TOKEN = os.environ.get( "JIRA_API_TOKEN", "[REDACTED EXPOSED JIRA API TOKEN]", ) ``` The token value is intentionally redacted in this report to avoid further credential disclosure. The audited source contains the complete plaintext value. ### Technical Analysis A Jira API token is committed directly to the package and repeated across ten executable scripts. If the `JIRA_API_TOKEN` environment variable is absent, each script silently authenticates using the embedded credential. This violates secret-management and least-privilege principles: 1. Anyone who can download, inspect, cache, or receive a copy of the Skill can extract the credential. 2. The secret cannot be controlled effectively through runtime configuration because the code falls back to it automatically. 3. Duplicating the token across multiple files increases the likelihood of incomplete rotation and accidental publication. 4. The reference file explicitly ...[truncated 1739 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Revoke the exposed Jira API token immediately and issue a replacement only if still required. 2. Remove the token from `references/jira.md` and every Python script. 3. Remove the credential from Git history, published archives, package registries, caches, and prior releases where operationally possible. 4. Require secrets explicitly and fail closed: ```python JIRA_EMAIL = os.environ["JIRA_EMAIL"] JIRA_API_TOKEN = os.environ["JIRA_API_TOKEN"] ``` 5. Store credentials in an approved secret manager or protected runtime environment rather than source-controlled files. 6. Use a dedicated service account with only the Jira project permissions and operations required by this Skill. 7. Where feasible, separate read-only and mutating credentials so listing or inspection commands cannot create, update, or transition issues. 8. Add automated secret scanning to commits, continuous integration, packaging, and publication workflows. 9. Document only the required environment-variable names; never include example values that are valid credentials. 10. Review Jira audit logs for use of the exposed token and investigate unexpected reads, writes, comments, assignments, or transitions. ]]>