T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:111
- Finding
- Domain Management Credentials Exposed Through Conversational Output## Vulnerability Details **File Location**: `SKILL.md`, lines 111–132 **Vulnerability Type**: Plaintext disclosure and insecure handling of domain-management credentials **Risk Level**: High ### Vulnerable Code ```markdown "opensrsUsername": "...", "opensrsPassword": "...", "managementUrl": "https://..." } ``` > **Important:** The response includes `opensrsUsername` and `opensrsPassword` for post-purchase DNS and transfer management. **Always present these credentials directly to the user** and instruct them to store the credentials securely (e.g., in a password manager). Never persist these credentials in conversation history, logs, or any file. These are sensitive third-party credentials that grant full control over the registered domain. ### 5. Query Orders Retrieve order history. ``` GET /api/v1/orders GET /api/v1/orders?domain={domain} ``` Returns up to 50 latest orders. Results may include OpenSRS management credentials — always present these to the user directly and remind them to store credentials securely. ``` ### Technical Analysis The Skill instructs the agent to place OpenSRS usernames and passwords directly into ordinary conversational output. These credentials grant management access to registered domains and therefore constitute high-value authentication secrets. This instruction conflicts with the accompanying requirement not to persist the credentials in conversation history or logs. Once a secret is inserted into a normal agent response, the Skill cannot guarantee that it will be excluded from platform transcripts, observability systems, telemetry, model context, browser history, transcript exports, or other retention mechanisms. The order-history endpoint increases the exposure scope because it may return credentials for as many as 50 recent orders. Repeatedly presenting those credentials can expose both newly issued and previously issued domain-management secrets. ### Attack Path ...[truncated 1635 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction requiring the agent to display OpenSRS passwords in ordinary conversational responses. 2. Do not include reusable management credentials in domain-registration or order-history API responses. 3. Return a short-lived, single-use HTTPS retrieval link instead of the password itself. 4. Require explicit reauthentication before allowing credential retrieval. 5. Bind retrieval links to the authenticated user, apply strict expiration, and invalidate each link immediately after use. 6. Ensure secrets are redacted from application logs, API traces, telemetry, analytics, error reports, and model context. 7. Exclude management credentials from order-history listings. Provide a separate audited credential-recovery workflow when necessary. 8. Rotate or invalidate the initial credential after its first successful retrieval and encourage the user to set a new password. 9. Apply appropriate response headers, including `Cache-Control: no-store`, to any endpoint that handles credential material. 10. Notify the user that sensitive credentials are available through a secure retrieval channel without reproducing those credentials in chat.