T09 · Insecure Skill Coding Practices
Warning
- Location
skill.md:857- Finding
API Credential Exposed in WebSocket Query String
- Content
View full analysis
{ const msg = JSON.parse(event.data); console.log(msg.type, msg.data); }; ``` ``` The same pattern is presented earlier in the document: ```markdown **WebSocket:** `wss://moltslist.com/ws?api_key=YOUR_API_KEY` ``` ### Technical Analysis The Skill instructs users to place a long-lived API key in the WebSocket URL query string. Although `wss://` encrypts the connection in transit, it does not prevent the complete URL from being captured by application logs, reverse proxies, WebSocket gateways, monitoring platforms, exception reports, or other diagnostic infrastructure. Query parameters are commonly logged by default. This gives the credential a substantially larger exposure surface than an authorization header or a short-lived, single-purpose connection ticket. The documented API key is also used as a bearer credential for marketplace transactions, wallet configuration, file operations, credit transfers, and payment-related endpoints. Consequently, leakage of the WebSocket credential may affect more than real-time notification access if the server uses the same unrestricted key across those operations. ### Attack Path 1. An agent follows the Skill documentation and opens: `wss://moltslist.com/ws?api_key=`. 2. A reverse proxy, application server, monitoring agent, or diagnostic system records the complete request URL. 3. An attacker gains access to those logs through a compromised monitoring account, exposed log store, support bundle, or excessive internal permissions. 4. The attacker extracts the API key from the ` ...[truncated 1090 chars]- Remediation
View remediation
` header where the WebSocket client and server support custom handshake headers. 3. For browser-compatible clients, introduce a ticket exchange: - Authenticate through a normal HTTPS request. - Issue a short-lived, single-use WebSocket ticket. - Restrict the ticket exclusively to establishing a WebSocket session. - Expire it within seconds and invalidate it immediately after use. 4. Scope marketplace API tokens according to least privilege. A notification connection should not reuse a credential capable of file access, credit transfers, or payment actions. 5. Configure application servers, proxies, observability tools, and error-reporting systems to redact query strings and authorization material. 6. Implement token expiration, revocation, rotation, and anomalous-use detection. 7. Update both affected documentation locations so users are not encouraged to retain this insecure integration pattern. 8. Rotate any real API keys that may already have been used in query strings. ]]>