T09 · Insecure Skill Coding Practices
Warning
- Location
- references/mcp-client-config.json:7
- Finding
- Hardcoded MCP Bearer Credential in Distributed Configuration## Vulnerability Details **File Location**: `references/mcp-client-config.json`, lines 7–9 **Vulnerability Type**: Hardcoded secret / plaintext bearer credential **Risk Level**: Medium ```json "headers": { "Authorization": "Bearer mcp_171e1ffa7da343faa4ec43460c52b13f", "Content-Type": "application/json" } ``` ### Technical Analysis The distributable MCP client configuration contains a reusable bearer token in plaintext. Bearer credentials grant access based on possession, so anyone who can download, clone, inspect, or unpack the Skill can extract the token and submit authenticated requests independently of the intended client. The exposure is reinforced by `SKILL.md`, lines 47–50, which directs clients to the embedded preset and identifies it as having a prefilled Authorization header. No secret substitution, per-user credential provisioning, expiration control, or runtime secret-management mechanism is shown in the audited files. ### Attack Path 1. Obtain the published Skill package or access its source files. 2. Open `references/mcp-client-config.json`. 3. Copy the value of the `Authorization` header. 4. Send requests to `https://mcp.aigohotel.com/mcp` with the extracted bearer token. 5. Invoke any MCP operations permitted by that credential until it expires or is revoked. ### Impact Assessment An attacker can impersonate the credential holder to the MCP service and exercise the service capabilities authorized for this token. Confirmed documented capabilities include hotel search, hotel-detail retrieval, and search-tag retrieval. Potential operational consequences include unauthorized quota consumption, rate-limit exhaustion, misleading usage attribution, and service disruption caused by abuse or credential revocation. The audited project does not document the token's server-side permissions, account association, billing model, expiration, or administrative scope. Therefore, access beyond the MCP permissio ...[truncated 53 chars]
- Remediation
- ## Remediation Suggestions 1. Revoke the exposed bearer token immediately and issue a replacement because removal from the current package does not invalidate copies already distributed. 2. Remove the credential from the configuration file and all repository and package history. 3. Replace the literal value with runtime secret injection, such as an environment variable or an operating-system-backed secret manager. 4. Require each user or deployment to provide an individual credential rather than distributing one shared token. 5. Scope replacement credentials to only the required MCP operations and apply expiration, rotation, rate limits, and usage monitoring. 6. Add automated secret scanning to packaging and publication workflows so builds fail when bearer tokens or similar credentials are detected. 7. Document secure setup without including a working secret. For example: ```json { "mcpServers": { "aigohotel-mcp": { "url": "https://mcp.aigohotel.com/mcp", "type": "streamable_http", "headers": { "Authorization": "Bearer ${AIGOHOTEL_MCP_TOKEN}", "Content-Type": "application/json" } } } } ``` Confirm that the target MCP client securely supports environment-variable interpolation; otherwise, provision the header through its supported secret-storage mechanism.