T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:32- Finding
Plaintext API Key Persistence Without Required Access Controls
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 32–40
Vulnerability Type: Plaintext credential storage with insufficient filesystem safeguards
Risk Level: MediumVulnerable Code Snippet:
markdown 6. Resolve credentials only from `api_key` in the directory containing this `SKILL.md`. Read its first non-empty line. Do not inspect environment variables or any other local path. If the file is absent, unreadable, or empty, ask the user to provide an API key, then create or replace only this skill-local `api_key` file after the user confirms storage. Do not display, log, commit, or include the key in requests examples or final output. 7. Before uploading a document to ComPDF, identify the affected files and destination, and obtain confirmation unless the user has explicitly authorized that upload. Also obtain confirmation before operations that overwrite, delete, decrypt, or apply permanent protection. 8. Return the endpoint, method, content type, complete request fields, expected task/result fields, and the next polling or download step. Preserve original files unless replacement is explicitly requested. ## Credentials Store only the current skill's API key in the sibling `api_key` file. This file is private runtime state and must be excluded from version control and skill publishing. To obtain an API key, register or sign in at [ComPDF Portal](https://www.compdf.com/compdf-portal/signin?utm_source=clawhub&utm_medium=referral&utm_campaign=compdf_skills_repo_en&ref_platform_id=clawhub_compdfkit_skills_en). On first use, provide the key when requested and confirm storing it in the skill-local `api_key` file; later requests reuse that stored key.Technical Analysis
The Skill directs the agent to persist an API credential in an ordinary plaintext file named
api_key. It appropriately limits the credential lookup location, requires user approval before storage, and prohibits disclosure or version-con ...[truncated 2013 chars]- Remediation
View remediation
Remediation Suggestions
- Prefer an operating-system keychain or managed secret store instead of a plaintext project file.
- If file storage is unavoidable, create the file atomically with owner-only permissions such as
0600, and ensure the containing directory is not writable by untrusted principals. - Before every read or write, verify that the path is a regular file owned by the expected user and reject symbolic links and unexpected hard links.
- Avoid unsafe overwrite behavior. Write securely to an owner-only temporary file in the same directory and atomically rename it after validation.
- Add
api_keyto version-control and package-publication exclusion rules, while retaining the existing prohibition against logging or displaying it. - Provide an explicit command or workflow to delete the stored credential and document key rotation and revocation procedures.
- Minimize the key's server-side permissions and quotas where ComPDF supports such controls.