T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:269
- Finding
- API Token Disclosure Through Troubleshooting Command## Vulnerability Details **File Location**: `SKILL.md:269-271` **Vulnerability Type**: Sensitive credential exposure through terminal output **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown **Q7. Command starts and exits immediately without returning data?** > This is usually because `GUAIKEI_API_TOKEN` failed validation (see Q1). Before running, use `echo $GUAIKEI_API_TOKEN` to confirm that the variable has been injected. ``` The original instruction at line 271 explicitly directs the user to run: ```bash echo $GUAIKEI_API_TOKEN ``` ### Technical Analysis `GUAIKEI_API_TOKEN` is an authentication credential used in the `TOKEN` HTTP header when communicating with `www.guaikei.com`. Printing the environment variable reveals its complete value in plaintext. Terminal output may be retained in CI/CD logs, terminal recordings, remote-session logs, shell transcripts, diagnostic bundles, screenshots, or screen-sharing sessions. The command is unnecessary for determining whether the variable is configured because its presence can be checked without exposing its value. The application code itself does not log the token, and sending it over HTTPS to the documented API provider is consistent with the Skill's declared authenticated data-retrieval functionality. The vulnerability is limited to the troubleshooting instruction. ### Attack Path 1. A user encounters a token-validation or startup failure. 2. The user follows the troubleshooting guidance in `SKILL.md`. 3. The user runs `echo $GUAIKEI_API_TOKEN`. 4. The complete token appears in terminal output. 5. The output is captured by a CI system, terminal recorder, remote support session, screenshot, screen share, or copied diagnostic transcript. 6. A party with access to that output obtains the token. 7. The party can submit authenticated requests to the Guaikei API using the exposed credential until it expires or is revoked. ### Impact Assessment ...[truncated 555 chars]
- Remediation
- ## Remediation Suggestions Replace the credential-revealing command with a presence-only check: ```bash if [ -n "${GUAIKEI_API_TOKEN:-}" ]; then echo "GUAIKEI_API_TOKEN is configured" else echo "GUAIKEI_API_TOKEN is missing" fi ``` For debugging token formatting, report only non-sensitive metadata, such as length, and avoid printing any token characters: ```bash if [ -n "${GUAIKEI_API_TOKEN:-}" ]; then printf 'GUAIKEI_API_TOKEN is configured; length=%s\n' "${#GUAIKEI_API_TOKEN}" else echo "GUAIKEI_API_TOKEN is missing" fi ``` Additional hardening measures: - Explicitly warn users never to paste complete tokens into support tickets, chat messages, screenshots, or logs. - Redact authentication headers in all current and future debug logging. - Provide a documented token revocation and rotation process. - Advise affected users to rotate the token if they previously followed the vulnerable instruction in a logged or shared environment. - Use short-lived, narrowly scoped API tokens where supported.