T09 · Insecure Skill Coding Practices
- Location
SKILL.md:46- Finding
Plaintext API Credential Solicitation Through Conversational Context
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 46-48
Vulnerability Type: Plaintext sensitive credential handling
Risk Level: Mediummarkdown **Q1: Image Generation Service** > "You first need an AI service account capable of generating images. This tool currently uses the Seedream model on the Volcano Engine Ark platform. > Do you have a Volcano Engine Ark account? If so, please provide your API Key, which can be found under Volcano Engine Ark Console -> API Key Management."Technical Analysis
The skill explicitly directs the user to submit a reusable Volcano Engine API key through the conversation. This places the credential in the agent's conversational context rather than obtaining it through an environment variable, secret manager, or protected credential prompt.
Conversationally supplied secrets may be retained in chat history, execution traces, application logs, debugging telemetry, exported transcripts, or model context. Any operator or service with access to those records could potentially recover and reuse the key. The subsequent workflow uses the credential as a bearer token when communicating with the declared Volcano Engine API, meaning possession of the exposed value may be sufficient to authenticate requests.
No evidence was found that the skill intentionally transmits the key to an unrelated endpoint. The vulnerability is the insecure collection and handling method itself.
Attack Path
- A user activates the fashion-video-creator skill.
- The skill asks the user to provide a Volcano Engine API key in the conversation.
- The user pastes a valid reusable key into the chat.
- The credential becomes part of the conversation record and may also appear in logs, traces, backups, support exports, or debugging systems.
- An individual who obtains access to any retained record extracts the bearer token.
- The exposed key is reused against Volcano Engine APIs until it exp ...[truncated 578 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all instructions asking users to paste API keys into chat.
- Require the credential to be supplied through the
ARK_API_KEYenvironment variable or a supported secret-management facility. - Check only whether the secret is available; never print, echo, interpolate into errors, or include it in generated output.
- Redact authorization headers and credential-like values from HTTP diagnostics, traces, exception messages, and logs.
- Use a dedicated, revocable key restricted to the minimum required Volcano Engine models, endpoints, quota, and billing scope.
- Provide secure setup guidance, such as:
bash export ARK_API_KEY="value-entered-locally"The command should be entered directly in the user's trusted local environment and should not be sent through the conversation. 7. If the runtime supports secret prompts or operating-system credential stores, prefer those mechanisms over shell-history-visible environment setup. 8. Recommend immediate rotation of any key previously disclosed through chat, logs, issue trackers, or exported transcripts.