T09 · Insecure Skill Coding Practices
- Location
scripts/main.py:14- Finding
Hard-Coded Proxy Authentication Token
- Content
View full analysis
Vulnerability Details
File Location:
scripts/main.py, lines 14–15 and 27
Vulnerability Type: Hard-coded authentication secret
Risk Level: MediumVulnerable Code
python PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z") PROXY_URL = os.environ.get("PROXY_URL", "https://1439498936-fmw9ldxblp.ap-guangzhou.tencentscf.com")The embedded token is subsequently transmitted as an authentication header:
python headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}Technical Analysis
The source code contains a reusable proxy authentication token as the default value of the
PROXY_TOKENenvironment variable. Because the skill package is distributed to users, anyone with access to it can recover the token without executing the skill.The token is automatically sent in the
X-Proxy-Tokenheader to a fixed Tencent Cloud Function endpoint. An attacker can reproduce this request outside the skill and submit arbitrary parameter payloads accepted by the proxy. Using an environment variable does not protect the credential while a valid fallback secret remains embedded in the source.The audit did not verify the remote service's authorization policy, so the token's exact privileges cannot be established from the reviewed files. The exposed credential nevertheless eliminates secrecy as an authentication control.
Attack Path
- Obtain or download the skill package.
- Inspect
scripts/main.pyand extract the default proxy URL and token. - Construct an HTTPS POST request to the configured Tencent Cloud Function endpoint.
- Add the recovered value to the
X-Proxy-Tokenheader. - Submit requests directly to the proxy, independently of the intended skill interface.
- Repeatedly consume any operations, quotas, or backend access that the server associates with the token.
Impact Assessment
An attacker may impersonate an authorized skill client and consume the proxy service without possessing ...[truncated 494 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the hard-coded fallback and require protected secret injection:
python PROXY_TOKEN = os.environ.get("PROXY_TOKEN") if not PROXY_TOKEN: raise RuntimeError("PROXY_TOKEN is required")- Immediately revoke and rotate the exposed token, because removing it from a future release does not invalidate copies of the current package.
- Store and inject the replacement credential through the platform's secret manager rather than source code, documentation, metadata, command-line arguments, or committed configuration.
- Prefer short-lived, per-installation or per-user credentials over one shared static token.
- Enforce server-side authorization that limits the credential to the exact required operation, such as
get_lowest_picks. - Validate all request parameters on the proxy and reject undeclared tool names or unsupported fields.
- Apply per-credential rate limits, quotas, expiration, revocation, and abuse monitoring.
- Avoid treating possession of a publicly distributed client-side value as sufficient authentication. Where feasible, route requests through a trusted platform service that keeps credentials server-side.