T09 · Insecure Skill Coding Practices
- Location
config/qique.config.json:4- Finding
Hard-Coded Distribution API Credential in Tracked Configuration
- Content
View full analysis
Vulnerability Details
File Location:
config/qique.config.json:4-5
Vulnerability Type: Hard-coded secret and plaintext credential exposure
Risk Level: HighVulnerable Code
json { "app_id": "", "app_secret": "", "distribution_app_id": "longxiaqique", "distribution_app_secret": "d91f6adabcbe6aaadbfe41162e4777d1" }Technical Analysis
The non-example configuration contains a hard-coded distribution identifier and a secret-looking 32-character value. According to
references/methods.md,distributionAppSecretis incorporated into the signature of every API request:text sign = md5(appSecret + distributionAppSecret + concat(sorted(k+v)) + appSecret)Committing this credential to the Skill package exposes it to every party able to download, inspect, archive, or redistribute the project. It may also remain accessible through repository history even if removed from the current version.
The exposed distribution secret alone does not provide a complete request-signing capability because an application secret is also required. However, it eliminates one factor from the signing scheme. An attacker who separately obtains a valid application credential can combine it with this value and the publicly documented signing procedure to construct apparently valid request signatures.
Attack Path
- An attacker obtains or downloads the Skill package.
- The attacker reads
config/qique.config.json. - The attacker extracts the distribution identifier and distribution secret.
- The attacker acquires a valid
app_idandapp_secretthrough another compromise, accidental disclosure, or unauthorized access. - The attacker follows the signature algorithm documented in
references/methods.md. - The attacker constructs signed requests against the documented QiQue API endpoint.
- The privileges and accessible records are determined by the separately acquired application credentials and the server-side authorization model.
...[truncated 612 chars]
- Remediation
View remediation
Remediation Suggestions
- Immediately revoke and rotate the exposed distribution secret.
- Remove the real value from the current tree and repository history.
- Retain only placeholders in distributed configuration files, consistent with
config/qique.config.example.json. - Load the secret at runtime from a managed secret store or a protected environment variable.
- Restrict secret access to the minimum required service identity and environment.
- Prevent credentials from entering logs, model prompts, generated output, diagnostic messages, or source-control commits.
- Add automated secret scanning to pre-commit hooks and continuous integration.
- Audit API and repository logs for prior unauthorized use or retrieval of the exposed value.
- Prefer a modern keyed message authentication construction if the upstream protocol can be changed. The existing custom MD5 construction should not be treated as a substitute for secure secret management.