T09 · Insecure Skill Coding Practices
Warning
- Location
finance-image-generator.cjs:12- Finding
Hard-Coded Unsplash API Credential Exposed in Source Code
- Content
View full analysis
{ https.get(url, (res) => { // ... }).on('error', reject); }); } ``` ### Technical Analysis The application distributes an Unsplash API access key directly in its source code. Anyone who can read the project files, obtain a packaged copy of the Skill, or access a source-code archive can extract and reuse this credential independently of the intended application. The key is also placed in the URL query string. Credential-bearing URLs can be retained in HTTP client diagnostics, proxy logs, monitoring systems, and other infrastructure that records complete request URLs. There is no environment-variable lookup, secret-manager integration, runtime credential injection, or mechanism that prevents unauthorized reuse of the exposed key. ### Attack Path 1. An attacker obtains or reads the Skill package. 2. The attacker opens `finance-image-generator.cjs`. 3. The attacker extracts the API key declared at line 12. 4. The attacker submits independent requests to the Unsplash API using the extracted value as the `client_id` parameter. 5. Requests are attributed to the credential owner and consume the associated API quota until the key is rotated, revoked, or rate-limited. ### Impact Assessment The attacker obtains the API permissions granted to the exposed Unsplash credential. The practical scope is limited to the capabilities and quota ...[truncated 463 chars]- Remediation
View remediation