T09 · Insecure Skill Coding Practices
- Location
references/data.md:21- Finding
Plaintext Database and Web-Service Credentials Embedded in Documentation
- Content
View full analysis
Vulnerability Details
File Locations:
references/data.md:21references/data.md:370references/jydb.md:4-6SKILL.md:342
Vulnerability Type: Hardcoded credentials and insecure database transport configuration
Risk Level: HighVulnerable Code
csharp SqlHelperOptions.JYDBConnectionString = "Server=192.168.1.129;Database=JYDB;User Id=Traders;Password=abcd4321;Encrypt=false;TrustServerCertificate=True";The documentation also publishes credentials for the external data-dictionary service:
text https://dd.gildata.com/ (username: szsgdsjk01, password: gildata@123)The SQL Server connection string is duplicated in
references/jydb.md:4, while the data-dictionary credentials are duplicated inSKILL.md:342,references/data.md:370, andreferences/jydb.md:6.Technical Analysis
The project embeds reusable credentials directly in documentation that is distributed with the Skill. Anyone who can obtain the package can recover the SQL Server username and password without additional access or decryption.
The database configuration also sets
Encrypt=false, disabling SQL Server transport encryption.TrustServerCertificate=Truefurther establishes an unsafe configuration pattern because it would bypass normal certificate validation if encryption were later enabled without correcting that option.The database uses a private address, so exploitation requires access to the relevant internal network, a connected host, a VPN, an exposed forwarding service, or another network foothold. The external data-dictionary credentials can potentially be tested from any network where the service is reachable.
Attack Path
- An attacker downloads or otherwise obtains the Skill package.
- The attacker searches its documentation and extracts:
- The SQL Server host, database name, username, and password.
- The online data-dictionary username and password.
- If the attacker has network reachability to
192.168.1.129, ...[truncated 1208 chars]
- Remediation
View remediation
Remediation Suggestions
- Immediately revoke and rotate both published credential sets.
- Review authentication logs for the SQL Server and data-dictionary account for unexpected access.
- Remove all passwords from
SKILL.md,references/data.md,references/jydb.md, package archives, and repository history. - Replace embedded connection strings with environment-based configuration or a managed secret store:
csharp SqlHelperOptions.JYDBConnectionString = Environment.GetEnvironmentVariable("JYDB_CONNECTION_STRING") ?? throw new InvalidOperationException("JYDB_CONNECTION_STRING is not configured."); - Configure encrypted SQL Server transport with
Encrypt=trueandTrustServerCertificate=false. - Deploy a certificate whose identity and trust chain can be validated by clients.
- Replace shared accounts with individual or workload-specific credentials.
- Apply least-privilege permissions, restricting each account to only the required schemas and operations.
- Use short-lived credentials or centrally managed credential rotation where supported.
- Add automated secret scanning to package and release pipelines to prevent future publication of passwords and connection strings.