T09 · Insecure Skill Coding Practices
- Location
SKILL.md:34- Finding
Plaintext API Key Stored in the Skill Directory Without Enforced Access Controls
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 34–40
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: MediumVulnerable Code
markdown 6. Resolve credentials only from `api_key` in the directory containing this `SKILL.md`. Read its first non-empty line. Do not inspect environment variables or any other local path. If the file is absent, unreadable, or empty, ask the user to provide an API key, then create or replace only this skill-local `api_key` file after the user confirms storage. Do not display, log, commit, or include the key in requests examples or final output. 7. Before uploading a document to ComPDF, identify the affected files and destination, and obtain confirmation unless the user has explicitly authorized that upload. Also obtain confirmation before operations that overwrite, delete, decrypt, or apply permanent protection. 8. Return the endpoint, method, content type, complete request fields, expected task/result fields, and the next polling or download step. Preserve original files unless replacement is explicitly requested. ## Credentials Store only the current skill's API key in the sibling `api_key` file. This file is private runtime state and must be excluded from version control and skill publishing.Technical Analysis
The skill directs the agent to persist the ComPDF API key as plaintext in an
api_keyfile located within the skill directory. Although the instructions state that this file must not be committed or published, the audited package contains no.gitignoreor equivalent mechanism that enforces this exclusion. The instructions also do not require owner-only file permissions, ownership validation, atomic creation, or protection against symbolic-link replacement.Consequently, credential security depends on the ambient permissions and packaging practices of the host environment. If the project directory is readable by another local accoun ...[truncated 1838 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer an operating-system credential manager, managed secret store, or runtime secret-injection mechanism rather than a plaintext file in the skill package.
- If file-based storage is unavoidable, create the file with owner-only permissions, such as mode
0600, and place it in a private runtime-state directory outside the publishable project tree. - Add
/api_keyto a package-provided.gitignoreand to all release or archive exclusion rules. Add automated secret scanning to CI and release workflows. - Refuse to read from or write through symbolic links. Open the file using no-follow and exclusive-creation protections where supported, then validate its owner, type, and permissions.
- Write the credential atomically without exposing it through command-line arguments, logs, examples, temporary files, or error messages.
- Document credential revocation and rotation procedures, and rotate the key immediately if the skill directory has ever been committed, published, or shared.
- Restrict the ComPDF credential to the minimum available account scope, permissions, and usage limits.