T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:31- Finding
API Key Stored in a Plaintext Skill-Local File
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 31–39
Vulnerability Type: Plaintext credential storage
Risk Level: MediumComplete Code Snippet
markdown 6. Resolve credentials only from `api_key` in the directory containing this `SKILL.md`. Read its first non-empty line. Do not inspect environment variables or any other local path. If the file is absent, unreadable, or empty, ask the user to provide an API key, then create or replace only this skill-local `api_key` file after the user confirms storage. Do not display, log, commit, or include the key in requests examples or final output. 7. Before uploading a document to ComPDF, identify the affected files and destination, and obtain confirmation unless the user has explicitly authorized that upload. Also obtain confirmation before operations that overwrite, delete, decrypt, or apply permanent protection. 8. Return the endpoint, method, content type, complete request fields, expected task/result fields, and the next polling or download step. Preserve original files unless replacement is explicitly requested. ## Credentials Store only the current skill's API key in the sibling `api_key` file. This file is private runtime state and must be excluded from version control and skill publishing. To obtain an API key, register or sign in at [ComPDF Portal](https://www.compdf.com/compdf-portal/signin?utm_source=clawhub&utm_medium=referral&utm_campaign=compdf_skills_repo_en&ref_platform_id=clawhub_compdfkit_skills_en). On first use, provide the key when requested and confirm storing it in the skill-local `api_key` file; later requests reuse that stored key.Technical Analysis
The Skill instructs the agent to persist an API key in a plaintext file named
api_key. It appropriately limits credential lookup to the Skill directory, requires user confirmation before storage, and prohibits displaying or logging the key. However, it does not requi ...[truncated 1672 chars]- Remediation
View remediation
Remediation Suggestions
- Prefer an operating-system credential manager or a platform-provided secret store instead of a plaintext project file.
- If file-based storage is unavoidable, create the file atomically with owner-only permissions such as
0600, and verify the resulting ownership and permissions before use. - Reject symbolic links and other non-regular files before creating, replacing, or reading
api_keyto prevent redirection to an unintended path. - Add and verify an explicit version-control ignore rule for
/api_key, and exclude the file from packaging, backup, and publishing workflows. - Avoid replacing an existing credential until the destination has been validated and the user has confirmed the operation.
- Document key revocation and rotation procedures so a potentially exposed credential can be invalidated promptly.
- Use a narrowly scoped key, if ComPDF supports scopes, quotas, or project-level restrictions.