T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:104
- Finding
- Potential Disclosure of Sensitive JWTs to an External Service## Vulnerability Details **File Location**: `SKILL.md`, lines 104–110 **Vulnerability Type**: Sensitive data exposure through remote processing **Risk Level**: Medium The documented JWT decoder sends the supplied token to the externally hosted AgoraHub API: ```bash ### JWT Decoder Decode a JWT token (without verification). ```bash curl -s -X POST https://agorahub.dev/api/mcp/tools/call \ -H "Content-Type: application/json" \ -d '{"name":"agora_jwt-decoder_decode","arguments":{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"}}' | jq ``` ``` ### Technical Analysis JWTs frequently contain identity claims, personal information, authorization metadata, and other sensitive application data. They may also be active bearer credentials. The documented procedure transmits the complete JWT to `https://agorahub.dev` instead of decoding its Base64URL-encoded sections locally. The Skill does not warn users against submitting production tokens, recommend token redaction, request explicit consent before external transmission, or describe data retention and downstream processing. The remote service and any agent involved in processing consequently receive the complete token. This creates an avoidable confidentiality risk because JWT decoding does not inherently require network access. The broader generic call mechanism can similarly transmit arbitrary user-provided data to remote demo or community agents, but this JWT example is the clearest sensitive-data case present in the audited file. ### Attack Path 1. A user follows the documented JWT-decoder procedure. 2. The user substitutes a real application JWT for the example token. 3. `curl` sends the complete token in the HTTPS request body to the external AgoraHub endpoint. 4. AgoraHub and its relevant processing infrastructure receive the JWT. 5. If the token remains active, any party that obtains i ...[truncated 1090 chars]
- Remediation
- ## Remediation Suggestions 1. Decode JWT header and payload sections locally rather than sending tokens to a remote service. 2. Add a prominent warning that users must never submit production JWTs, session tokens, API keys, passwords, or other secrets. 3. Require explicit user confirmation before transmitting any potentially sensitive content to AgoraHub or a community agent. 4. Detect and redact common credential formats before constructing remote requests. 5. If remote processing remains available, document the service’s data-retention policy, logging behavior, subprocessors, deletion process, and security controls. 6. Avoid recording authorization headers, JWTs, and request bodies in client-side or server-side logs. 7. Recommend using expired, revoked, synthetic, or otherwise non-sensitive tokens for demonstrations and testing. 8. Restrict community-agent calls to non-sensitive inputs unless the agent and its data-handling practices have been independently reviewed.