T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:78
- Finding
- Plaintext PostgreSQL Administrator Credentials Exposed in Skill Documentation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 78-83 **Vulnerability Type**: Hard-coded plaintext credentials **Risk Level**: High ### Vulnerable Code ```markdown ## Database Configuration (roadflow) - **Host**: 192.168.1.136 - **Port**: 35438 - **User**: postgres - **Password**: Hxkj510510 - **Target Database**: roadflow ``` ### Technical Analysis The Skill documentation contains a complete PostgreSQL connection profile, including a plaintext password and the privileged-looking `postgres` username. Anyone who can read the Skill package can recover the credential without needing to inspect runtime configuration or defeat any access controls. Secrets committed to documentation are also likely to persist in package archives, backups, caches, and source-control history after the visible value is removed. Although the database uses a private IP address, that does not make the credential safe: users, agents, compromised hosts, or services with access to the relevant internal network could attempt to use it. The audit could not verify whether the credential remains active or determine its exact database privileges. Nevertheless, publishing a password in the package is independently an insecure credential-management practice. ### Attack Path 1. An attacker obtains read access to the Skill package or a copy of its documentation. 2. The attacker reads `SKILL.md` and extracts the host, port, username, password, and database name. 3. From a host that can reach `192.168.1.136:35438`, the attacker attempts to authenticate to PostgreSQL with the disclosed credentials. 4. If the credential is active, the attacker performs operations permitted to the `postgres` account. 5. If the password has been reused, the attacker may attempt to authenticate to other related database instances or services. ### Impact Assessment If the credential is valid and the database is reachable, the attacker could obtain all privileges assigned to the disclosed acc ...[truncated 512 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed password immediately; do not merely remove it from the current document. 2. Review PostgreSQL authentication logs for use of the exposed account from unexpected hosts. 3. Search source-control history, package registries, build artifacts, backups, and caches for additional copies of the credential. 4. Replace the `postgres` account with a dedicated RoadFlow service account that has only the table and operation permissions required by the Skill. 5. Store the replacement credential in an approved secret manager. If that is unavailable, obtain it through protected runtime environment variables rather than committing it to files. 6. Document only placeholder configuration, such as `ROADFLOW_DB_HOST` and `ROADFLOW_DB_PASSWORD`. 7. Restrict database ingress to explicitly authorized hosts and require encrypted PostgreSQL connections. 8. Establish automated secret scanning in commit and release pipelines to prevent recurrence. ]]>