T09 · Insecure Skill Coding Practices
- Location
references/mcp-client-config.json:7- Finding
Hardcoded MCP Bearer Token Exposes Service Credentials
- Content
View full analysis
Vulnerability Details
File Location:
references/mcp-client-config.json, line 7
Vulnerability Type: Hardcoded authentication credential
Risk Level: HighVulnerable Code
json "headers": { "Authorization": "Bearer mcp_171e1ffa7da343faa4ec43460c52b13f", "Content-Type": "application/json" }Technical Analysis
A live-looking bearer token is embedded directly in a client configuration file distributed with the skill. Anyone who can read the package, source repository, build artifact, registry publication, logs, or backups can extract this credential without needing additional privileges.
Bearer tokens generally grant access based solely on possession. The configuration identifies the associated endpoint as
https://mcp.aigohotel.com/mcp, allowing the exposed token to be replayed against that service. No malicious behavior by the skill itself was identified; the vulnerability is the insecure distribution of authentication material.Attack Path
- An attacker downloads the skill package or reads a public or otherwise accessible copy of the repository.
- The attacker opens
references/mcp-client-config.jsonand extracts the value of theAuthorizationheader. - The attacker sends requests to
https://mcp.aigohotel.com/mcpusing the copied bearer token. - If the token remains valid, the service treats the attacker as the token owner and permits operations within the token's assigned authorization scope.
- The attacker may automate requests, consume service quota, access data exposed to that credential, or cause billable activity until the token is revoked, expires, or is otherwise restricted.
Impact Assessment
Successful exploitation requires only read access to a distributed copy of the skill. It may allow unauthorized use of the MCP service under the credential owner's identity, including invocation of hotel-search or related MCP capabilities available to the token. Potential consequences include quota exhaust ...[truncated 406 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke and rotate the exposed token immediately. Treat it as compromised even if the project was not intentionally published.
- Remove the credential from the configuration and replace it with a runtime-injected secret, for example:
json { "mcpServers": { "aigohotel-mcp": { "url": "https://mcp.aigohotel.com/mcp", "type": "streamable_http", "headers": { "Authorization": "Bearer ${AIGOHOTEL_MCP_TOKEN}", "Content-Type": "application/json" } } } }- Store the token in an approved secret manager, operating-system credential store, or protected environment variable rather than in the skill package.
- Ensure packaging and publication processes exclude local credential files. Distribute a sanitized example configuration such as
mcp-client-config.example.json. - Review repository history, release archives, registry artifacts, CI logs, and backups for earlier copies. Removing the token only from the latest version does not remove it from historical artifacts.
- Add automated secret scanning to pre-commit and CI workflows to block bearer tokens and similar credentials before publication.
- Apply least privilege, short expiration, audience restrictions, rate limits, and usage alerts to replacement tokens.
- Review server logs for unexpected requests made with the exposed token and investigate anomalous usage, quota consumption, or data access.