T09 · Insecure Skill Coding Practices
Error
- Location
- USAGE_GUIDE.md:206
- Finding
- Live API credentials committed in project documentation<![CDATA[ ## Vulnerability Details **File Location**: `USAGE_GUIDE.md:206-208`; duplicate Kimi credential exposures also occur at `QUICK_START.md:28` and `README.md:39` **Vulnerability Type**: Hardcoded credentials and plaintext secret exposure **Risk Level**: Critical ### Vulnerable Code The exposed values are redacted below to avoid further disclosure: ```bash export APIDANCE_API_KEY="[REDACTED EXPOSED APIDANCE API KEY]" export TWITTER_AUTH_TOKEN="[REDACTED EXPOSED TWITTER AUTH TOKEN]" export KIMI_API_KEY="[REDACTED EXPOSED KIMI API KEY]" ``` The Kimi credential is also embedded in these instructions: ```bash # QUICK_START.md:28 export KIMI_API_KEY="[REDACTED EXPOSED KIMI API KEY]" ``` ```bash # README.md:39 export KIMI_API_KEY="[REDACTED EXPOSED KIMI API KEY]" ``` ### Technical Analysis The documentation contains credential-shaped values presented as active environment-variable configuration rather than placeholders. The same Kimi API key is repeated across three tracked files. Secrets committed to a project are exposed to every person or system that can read the project, including source-control mirrors, build systems, artifact archives, code-indexing services, backups, and AI tooling. Removing the values only from the current version is insufficient if they have entered source-control history or previously generated artifacts. The Twitter authentication token is particularly sensitive because the implementation uses it to authorize state-changing account operations, including posting, replying, liking, retweeting, following, unfollowing, and deleting tweets. The API keys can also be abused to consume paid service quotas. ### Attack Path 1. An attacker obtains read access to the project, an archive, a source-control clone, or indexed documentation. 2. The attacker searches for common secret prefixes or environment-variable names such as `APIDANCE_API_KEY`, `TWITTER_AUTH_TOKEN`, and `KIMI_API_KEY`. 3. The attacker extracts the plaintext values fro ...[truncated 1117 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate all three exposed credentials. 2. Treat rotation as mandatory even if the values are believed to be expired. 3. Replace every embedded value with unmistakable placeholders: ```bash export APIDANCE_API_KEY="your-apidance-api-key" export TWITTER_AUTH_TOKEN="your-twitter-auth-token" export KIMI_API_KEY="your-kimi-api-key" ``` 4. Remove the secrets from source-control history using an appropriate history-rewriting tool. 5. Invalidate cached artifacts, release packages, backups, and CI logs containing the original values where feasible. 6. Store runtime credentials in environment variables or a dedicated secret manager. 7. Ensure `.env`, `.env.local`, logs, and generated credential files are excluded from source control. 8. Add pre-commit and CI secret scanning to reject credential-shaped values. 9. Restrict each replacement credential to the minimum required privileges and quotas. 10. Review service audit logs for unauthorized activity beginning from the earliest possible exposure date. ]]>