T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:271
- Finding
- API Token Disclosure Through Troubleshooting Command## Vulnerability Details **File Location**: `SKILL.md:271` **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Medium **Complete Code Snippet**: ```markdown **Q7. Command exits immediately without producing data?** > Check: in most cases, `GUAIKEI_API_TOKEN` did not pass validation (see Q1). Before running, execute `echo $GUAIKEI_API_TOKEN` to confirm that the variable was injected. ``` ### Technical Analysis The troubleshooting instructions tell users to print the complete `GUAIKEI_API_TOKEN` value to the terminal. Although the application code otherwise sends this credential through an HTTPS header to the fixed API host, explicitly rendering the secret creates an unnecessary disclosure path. Terminal output may be retained in CI/CD logs, remote shell recordings, support transcripts, screen-sharing sessions, or copied diagnostic output. An attacker does not need code execution or elevated local privileges if they can observe or retrieve one of these output channels. ### Attack Path 1. A user encounters a token-validation or startup error. 2. The user follows `SKILL.md:271` and runs `echo $GUAIKEI_API_TOKEN`. 3. The complete API token is displayed in plaintext. 4. The output is observed, recorded, copied into a support request, or retained by an automated logging system. 5. An unauthorized party retrieves the exposed token. 6. The party reuses it to authenticate requests to the Guaikei API until the credential expires or is revoked. ### Impact Assessment Exposure can permit unauthorized use of the affected user's Guaikei API authorization, including consumption of account quotas and access to API operations allowed by that token. The available privileges are bounded by the token's server-side permissions; the reviewed project provides no evidence that the token grants operating-system access or broader local privileges. The issue does not expose unrelated environment variables automaticall ...[truncated 65 chars]
- Remediation
- ## Remediation Suggestions - Remove the instruction to print the token. - Verify only whether the environment variable is present: ```sh if [ -n "${GUAIKEI_API_TOKEN:-}" ]; then echo "GUAIKEI_API_TOKEN is configured" else echo "GUAIKEI_API_TOKEN is missing" fi ``` - If identification is essential, show only a short masked suffix and never the complete value. - Add explicit documentation warning users not to include credentials in logs, screenshots, issue reports, or support transcripts. - Recommend immediate token revocation and rotation if the value has already been exposed. - Ensure CI/CD systems mask `GUAIKEI_API_TOKEN` and related secret values in captured output.