T09 · Insecure Skill Coding Practices
- Location
scripts/main.py:10- Finding
Hard-Coded Proxy Authentication Token
- Content
View full analysis
Vulnerability Details
File Location:
scripts/main.py, lines 10–11 and 18–22
Vulnerability Type: Hard-coded secret in distributed source code
Risk Level: HighVulnerable Code
python PROXY_URL = os.environ.get("PROXY_URL", "https://1439498936-49sz8cryfx.ap-guangzhou.tencentscf.com") PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")python req = urllib.request.Request( PROXY_URL, data=body, method="POST", headers={"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}, )Technical Analysis
The project embeds a reusable proxy authentication token in plaintext as the default value of
PROXY_TOKEN. Because the token is distributed with the source package, any person able to download or inspect the Skill can recover it without authorization.The application automatically places this token in the
X-Proxy-Tokenrequest header. Environment-based configuration does not mitigate the exposure because the embedded value remains active wheneverPROXY_TOKENis unset.The proxy URL is also configurable independently. If an attacker or deployment misconfiguration controls
PROXY_URLbut leavesPROXY_TOKENunset, the application sends the embedded token to that alternate endpoint. This creates an additional credential-disclosure path.Attack Path
- An attacker obtains the publicly distributed or otherwise accessible Skill package.
- The attacker inspects
scripts/main.pyand extracts the plaintext proxy token. - The attacker constructs requests to the default proxy and supplies the recovered value in the
X-Proxy-Tokenheader. - The attacker invokes proxy operations using the Skill's credential until server-side authorization, scope, or rate limits block the requests.
- Alternatively, an attacker with control over the execution environment sets
PROXY_URLto an attacker-controlled HTTPS endpoint while leavingPROXY_TOKENunset. - When any tool is invoked,
_call_proxytransmits ...[truncated 829 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove the plaintext fallback token from source code:
python PROXY_TOKEN = os.environ.get("PROXY_TOKEN") if not PROXY_TOKEN: raise RuntimeError("PROXY_TOKEN is required") -
Immediately revoke and rotate the exposed token. Treat it as compromised because it has already been distributed in source code.
-
Supply credentials through a managed secret facility, such as a cloud secret manager, deployment-platform secret store, or protected environment injection. Do not commit production secrets to the package or repository.
-
Validate
PROXY_URLagainst an explicit allowlist of trusted HTTPS origins. If endpoint customization is unnecessary, use a fixed trusted endpoint and do not permit environment-based replacement. -
Avoid sending credentials across redirects. Configure request handling to reject redirects to untrusted origins and verify the final destination before transmitting authentication headers.
-
Apply server-side least privilege. Restrict the replacement token to only the three required operations, impose rate and spending limits, and prevent access to unrelated proxy capabilities.
-
Add token expiration, rotation, revocation, and abuse-monitoring controls. Alert on unusual request volume, source locations, operation patterns, or repeated authorization failures.
-
Add automated secret scanning to development and release pipelines so embedded credentials block publication.
-