T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:108- Finding
Production Private Keys Are Directed into Plaintext Environment Files
- Content
View full analysis
` to generate a keypair (stored in `~/.chromia/`) 2. Provide the public key — readable via `cat ~/.chromia/.pubkey` or from CLI output 3. Store the **private key** (`~/.chromia/`) in `.env` as e.g. `ADMIN_PRIVKEY=` — it will be needed for signing admin transactions from the client 4. Add `.env` to `.gitignore` ``` Related policy: ```markdown ### Zero-Secret Policy - **NEVER** embed private keys, mnemonics, or secrets in Rell code or `chromia.yml` - Use `moduleArgs` with `"PLACEHOLDER_PUBKEY"` for admin keys in config - Store secrets in `.env` files; load via client-side tooling only - Add `.env` to `.gitignore` in every project ``` ### Technical Analysis The Skill explicitly instructs users to copy a production private key into a plaintext `.env` file within the project environment. Adding the file to `.gitignore` only reduces the likelihood of committing it to Git; it does not encrypt the key or protect it from: - Malicious or compromised dependencies running under the same user account. - Local processes with access to the project directory. - Backup, synchronization, indexing, or diagnostic tools. - Accidental inclusion in archives, build contexts, logs, or support bundles. - Frontend build systems that expose selected environment variables in generated assets. - Excessively permissive filesystem permissions. The key is described as an administrative signing credential. Its confidentiality therefore directly protects privileged blockchain operations. ### Attack Path 1. A developer follows the Skill and copies the production private key into `.env` as `ADMIN_PRIVKEY`. 2. A malicious package, compromised build tool, local process ...[truncated 1134 chars]- Remediation
View remediation