T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:599
- Finding
- API Key Exposure Through Troubleshooting Command## Vulnerability Details **File Location**: `SKILL.md`, lines 599–603 **Vulnerability Type**: Secret exposure through terminal output **Risk Level**: Medium ### Vulnerable Code ```bash echo $MATON_API_KEY ``` ### Technical Analysis The troubleshooting instructions tell users or agents to print the complete `MATON_API_KEY` value. Because this value is used as a bearer credential in the documented `Authorization` header, possession of it may be sufficient to authenticate to Maton services. Terminal output can be retained in agent tool transcripts, CI/CD logs, shell session recordings, screenshots, support tickets, or copied diagnostic output. Printing the secret therefore unnecessarily expands its exposure beyond the process environment. The command is not required to establish whether the variable exists; a presence-only check would provide the same diagnostic value without revealing the credential. ### Attack Path 1. A user or automated agent encounters an authentication problem. 2. It follows the troubleshooting instructions and runs `echo $MATON_API_KEY`. 3. The full bearer credential appears in terminal output. 4. That output is recorded in an agent transcript, build log, screen recording, or support material. 5. An attacker or unauthorized party with access to the recorded output extracts the key. 6. The exposed key is replayed against documented Maton gateway or connection-management endpoints, subject to the permissions and connections associated with that key. ### Impact Assessment Successful exploitation could allow an attacker to authenticate with the victim's Maton API key. Depending on the key's server-side permissions and connected accounts, this may expose connection metadata or permit WhatsApp Business operations, including sending messages, handling customer data, managing templates, accessing media-related endpoints, changing business-profile information, or deleting connections. The exact scope i ...[truncated 182 chars]
- Remediation
- ## Remediation Suggestions Replace the secret-printing command with a presence-only test: ```bash if [ -n "${MATON_API_KEY:-}" ]; then echo "MATON_API_KEY is set" else echo "MATON_API_KEY is not set" fi ``` Additional hardening measures: - Explicitly warn users never to print, log, paste, or screenshot the API key. - Redact authorization headers and credentials from agent transcripts, application logs, CI output, and support bundles. - Use narrowly scoped API keys where Maton supports scope restrictions. - Rotate the key immediately if it has appeared in retained or shared output. - Add secret-detection checks to documentation review and CI pipelines to reject examples that output credential values. - Prefer a dedicated authentication-validation operation that returns only validity status and never reflects the submitted credential.