T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:601
- Finding
- API Key Disclosure Through Troubleshooting Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:601-604` **Vulnerability Type**: Credential exposure through terminal and log output **Risk Level**: Medium ### Vulnerable Code ```bash 1. Check that the `MATON_API_KEY` environment variable is set: ```bash echo $MATON_API_KEY ``` ``` ### Technical Analysis The troubleshooting instructions recommend printing the complete `MATON_API_KEY` value to standard output. This does more than verify whether the environment variable is configured: it exposes the credential in plaintext. Terminal output may be retained in shell transcripts, CI/CD logs, remote-support sessions, Agent conversation histories, screen recordings, or centralized monitoring systems. It may also be copied into issue reports or support conversations while troubleshooting. Because the API key is used as a bearer credential for `gateway.maton.ai` and `ctrl.maton.ai`, possession of the value may be sufficient to authenticate requests without any additional proof of identity. ### Attack Path 1. A user encounters an authentication problem and follows the documented troubleshooting procedure. 2. The user runs `echo $MATON_API_KEY`. 3. The complete bearer credential appears in terminal output. 4. The output is captured by logs, an Agent transcript, screen sharing, or a copied diagnostic report. 5. An unauthorized party obtains the exposed value. 6. The party submits the key in an `Authorization: Bearer` header to Maton endpoints. 7. Subject to the key's server-side permissions, the party can interact with associated WhatsApp connections and resources. ### Impact Assessment Successful exploitation may allow unauthorized use of the Maton account and its connected WhatsApp Business resources. The accessible scope depends on the privileges assigned to the exposed API key, but documented operations include listing and deleting connections, sending WhatsApp messages, managing templates, accessing media metadata, and modifying business-pr ...[truncated 188 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace direct credential printing with a presence-only check: ```bash if [ -n "${MATON_API_KEY:-}" ]; then echo "MATON_API_KEY is configured" else echo "MATON_API_KEY is not configured" fi ``` - If diagnostic identification is necessary, display only a short, non-sensitive fingerprint rather than any reusable portion of the key. - Add an explicit warning that API keys must not be pasted into Agent conversations, support tickets, screenshots, or logs. - Ensure CI/CD systems mask `MATON_API_KEY` and other bearer credentials. - Recommend rotating the API key immediately if it has been printed into a retained or shared output channel. - Where supported, use narrowly scoped, short-lived credentials and enforce server-side revocation and expiration. ]]>