T09 · Insecure Skill Coding Practices
- Location
SKILL.md:7- Finding
Hardcoded OKX Trading API Credential
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 7
Vulnerability Type: Plaintext hardcoded API credential
Risk Level: HighVulnerable Code
markdown - **API Key**: 418d477d-7247-4df9-9270-66055550c1ccTechnical Analysis
The skill documentation embeds an OKX API key directly in a repository-tracked plaintext file. Nearby configuration states that the associated credential has read and trading permissions, although it does not have withdrawal permission. Anyone who can read the skill package, repository history, build artifacts, backups, or logs containing this file can recover the exposed key.
OKX authentication commonly requires additional authentication material, such as a secret and passphrase. Those values are not present in the audited file, so the API key alone cannot be assumed to provide immediate authenticated access. Nevertheless, exposing one component of a privileged credential reduces authentication security and enables account targeting, credential correlation, and abuse if the remaining components are leaked, reused, weakly protected, or otherwise obtained.
Attack Path
- An attacker obtains read access to the skill package, repository, published artifact, backup, or copied documentation.
- The attacker extracts the API key from
SKILL.md. - The attacker identifies the associated OKX account using the account metadata present in the same file.
- The attacker attempts to obtain or correlate the required companion secret and passphrase through another disclosure, reused configuration, compromised environment, logs, or social engineering.
- If all required authentication material is recovered and the key remains active, the attacker submits authenticated OKX API requests.
- Based on the documented permissions, the attacker may query account information or place unauthorized trades. Withdrawal is reportedly disabled, but malicious trading could still cause financial lo ...[truncated 740 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke the exposed API key immediately and create a replacement; removal from the current file does not eliminate copies in repository history, caches, backups, or distributed artifacts.
- Remove API credentials and sensitive account identifiers from
SKILL.mdand all other tracked files. - Store the replacement key, secret, and passphrase in a managed secret store or protected environment variables injected only at runtime.
- Ensure secrets are never printed in application logs, error messages, diagnostic output, or audit artifacts.
- Apply least privilege. Use a read-only credential unless trading access is strictly required, and separate market-data, account-reading, and trading credentials where practical.
- Retain withdrawal restrictions and configure an IP allowlist so the key is accepted only from approved hosts or egress addresses.
- Add repository secret scanning and pre-commit checks to prevent future credential commits.
- Review OKX access and trading logs for use of the exposed key, including unknown source addresses, unexpected account queries, and unauthorized orders.
- Rotate any companion secret or passphrase that may have been stored or distributed with this key elsewhere.