T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/auth_setup.py:30
- Finding
- Sensitive CLOB API Credentials Disclosed Through Console Output## Vulnerability Details **File Location**: `scripts/auth_setup.py`, lines 30–32 **Vulnerability Type**: Sensitive credential exposure through console and log output **Risk Level**: High ### Vulnerable Code ```python creds = authenticate_with_clob(private_key) print("API creds derived:", creds) ``` The `authenticate_with_clob()` function returns authentication material described by the code as an API key, secret, and passphrase. The example entry point prints the complete returned object without redaction. ### Technical Analysis Console output is frequently captured by terminal history, CI/CD logs, process supervisors, container logging drivers, hosted execution environments, and centralized monitoring systems. Consequently, printing the credential object expands access to sensitive trading credentials beyond the bot process and violates least-disclosure principles. The private wallet key itself is not printed or transmitted by this statement. However, the exposed CLOB credentials may be reusable for authenticated account operations, depending on the permissions and authentication requirements enforced by the service. ### Attack Path 1. A user sets `POLY_PRIVATE_KEY` and runs `scripts/auth_setup.py`. 2. The script signs the authentication message and requests CLOB credentials from the configured Polymarket endpoint. 3. The endpoint returns an API key, secret, and passphrase. 4. Lines 30–31 store and print the full credential object. 5. Terminal output is retained in a log, CI job, container log, or process-supervisor journal. 6. An attacker or unauthorized operator with access to that output extracts the credentials. 7. The attacker attempts authenticated CLOB operations using the exposed credentials, subject to the account permissions and any additional controls imposed by the service. ### Impact Assessment An attacker who obtains valid trading credentials may be able to impersonate the affected CLOB account and perform authenticated operations, pote ...[truncated 396 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the credential value from all output: ```python creds = authenticate_with_clob(private_key) print("CLOB API credentials derived successfully.") ``` 2. If an identifier is operationally necessary, expose only a minimally useful redacted value: ```python api_key = creds.get("apiKey", "") masked = f"{api_key[:4]}...{api_key[-4:]}" if len(api_key) >= 8 else "[redacted]" print(f"CLOB authentication succeeded for key {masked}.") ``` 3. Add logging filters that redact fields such as `apiKey`, `secret`, `passphrase`, `private_key`, and authorization headers before messages reach any handler. 4. Avoid serializing credential objects in exceptions, debug logs, telemetry, crash reports, or tracing systems. 5. Restrict access to CI, container, and process-supervisor logs and configure short retention periods for sensitive workloads. 6. Rotate or revoke credentials that may previously have been printed. Review relevant logs and authenticated account activity for unauthorized use. 7. Keep credentials in memory only as long as required and pass them exclusively to the documented authentication client or request-signing mechanism.