T09 · Insecure Skill Coding Practices
- Location
scripts/main.py:10- Finding
Hardcoded Proxy Authentication Token
- Content
View full analysis
Vulnerability Details
File Location:
scripts/main.py, lines 10 and 19
Vulnerability Type: Hardcoded secret
Risk Level: HighVulnerable Code
python PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")The credential is subsequently transmitted in an HTTP request header:
python headers={"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN},Technical Analysis
The source code embeds a proxy authentication token as the default value of the
PROXY_TOKENenvironment variable. Because the source is distributed as part of the skill package, anyone with access to the package can extract the credential without executing the skill.The environment-variable override does not protect the embedded fallback value. When
PROXY_TOKENis absent, every proxy request automatically uses the exposed credential. An attacker can copy the request structure from_call_proxyand reuse the token outside the intended agent environment.Additionally,
PROXY_URLis configurable through an environment variable. If an attacker can influence the skill's environment, they can direct requests to an attacker-controlled HTTPS endpoint and receive the token through theX-Proxy-Tokenheader. The primary confirmed issue remains public disclosure of the hardcoded token.Attack Path
- Obtain or inspect the distributed skill package.
- Open
scripts/main.pyand extract the fallback token from line 10. - Copy the request format implemented by
_call_proxy, including theX-Proxy-Tokenheader. - Send requests directly to the default proxy endpoint using the exposed token.
- Invoke any operations authorized for that credential until it is revoked, expires, or server-side restrictions block further use.
An alternative path is possible where an attacker controls the execution environment:
- Set
PROXY_URLto an attacker-controlled HTTPS endpoint. - Run any skill tool without overriding
PROXY_TOKEN. - Capture the fa ...[truncated 748 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the hardcoded fallback token and fail securely when the credential is unavailable:
python PROXY_TOKEN = os.environ.get("PROXY_TOKEN") if not PROXY_TOKEN: raise RuntimeError("PROXY_TOKEN must be provided through secure configuration")- Rotate and revoke the exposed token immediately because inclusion in a distributed package must be treated as credential compromise.
- Store the replacement credential in a managed secret store or protected runtime environment rather than source code, documentation, package metadata, or deployment artifacts.
- Issue a narrowly scoped credential that permits only the required proxy operations.
- Apply server-side expiration, rate limits, usage quotas, request validation, and monitoring.
- Restrict the credential to the intended service, deployment identity, or audience where supported.
- Avoid unrestricted production overrides of
PROXY_URL. Use an allowlisted endpoint or validate the destination against an exact trusted origin before attaching credentials. - Add automated secret scanning to source-control and release pipelines to prevent future embedded credentials.
- Review proxy access logs for unauthorized use of the exposed token and investigate anomalous requests.