T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:152- Finding
Reusable ZeeLin App-Key Is Disclosed to an Intermediary Backend
- Content
View full analysis
" } ``` ``` From `SKILL.md:242-246`: ```markdown **POST** `https://melodylab.top/api/zeelin-confirm` ```json { "pre_order_id": "", "zeelin_app_key": "" } ``` ``` The same credential flow is also documented in `README.md:88-99`. ### Technical Analysis The Skill asks the user for a reusable billing credential issued by `skills.zeelin.cn`. Although direct submission of that credential to its issuer for validation may be expected, the Skill subsequently sends the same credential to the separate `melodylab.top` service. Music generation does not inherently require the intermediary backend to possess a reusable account credential. A least-privilege design would instead use a short-lived authorization artifact restricted to one order, one Skill, and a maximum charge amount. Giving MelodyLab the original App-Key creates a credential-boundary violation. The key may be exposed through: - A compromise of the MelodyLab backend. - Request or application logs containing request bodies. - Debugging, observability, tracing, or error-reporting systems. - An insider with access to backend traffic or stored logs. - Accidental forwarding to other services. - Replay by any party that obtains the credential. The reviewed package contains no exe ...[truncated 1839 chars]- Remediation
View remediation