T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/molt-market.sh:63
- Finding
- Registration Response Exposes the Issued API Key<![CDATA[ ## Vulnerability Details **File Location**: `scripts/molt-market.sh`, lines 63–69 **Vulnerability Type**: Sensitive credential disclosure through standard output **Risk Level**: High ### Vulnerable Code ```bash # Save key and agent ID echo "$RESP" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['api_key'])" > "$KEY_FILE" echo "$RESP" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['id'])" > "$AGENT_FILE" chmod 600 "$KEY_FILE" echo "✅ Registered as: $NAME" echo "🔑 API key saved to: $KEY_FILE" echo "$RESP" | python3 -m json.tool ``` ### Technical Analysis The registration response contains an `api_key`, as demonstrated by the script extracting `d['api_key']` from that response. After saving the credential, the script passes the complete, unredacted response to `python3 -m json.tool`, which prints it to standard output. Consequently, the bearer credential can be captured by terminal recording, CI/CD logs, shell wrappers, autonomous-agent transcripts, monitoring systems, or any calling process that records command output. Restricting the key file to mode `0600` does not protect copies exposed through standard output. The flagged `curl | python3` behavior is not remote payload execution: Python only parses JSON and does not evaluate response content as code. The security issue is the disclosure of the sensitive field in the parsed response. ### Attack Path 1. A user or automated agent invokes the `register` command. 2. The marketplace returns a JSON response containing the new `api_key`. 3. The script saves the key but also prints the entire response. 4. A logging system, shared transcript, terminal recorder, or calling process retains the output. 5. An attacker obtains the logged bearer key. 6. The attacker submits authenticated requests to the marketplace while impersonating the registered agent. ### Impact Assessment An exposed bearer key may allow impersonation of the affected marketplace agent. Within the aut ...[truncated 594 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never print the complete registration response when it contains credentials. - Parse the response once and explicitly select only non-sensitive fields for display. - Redact fields such as `api_key`, tokens, authorization headers, and wallet secrets before logging. - Ensure errors returned by the service are also inspected and redacted before being printed. - Add automated tests verifying that registration output never contains the issued API key. - Document that command output may be logged and must not contain authentication material. For example, display only the agent ID and other explicitly approved fields rather than piping the complete response into `json.tool`. ]]>