T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/skillpay.js:6
- Finding
- Hardcoded Billing API Credential Exposed in Source Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/skillpay.js:6-7, 20-28, 49-57` **Vulnerability Type**: Hardcoded secret and sensitive credential transmission **Risk Level**: High ### Vulnerable Code ```js const BILLING_API_URL = 'https://skillpay.me'; const BILLING_API_KEY = process.env.SKILLPAY_API_KEY || 'sk_a267a27a1eb8381a762a9a6cdb1ea7d722f9f45f345b7319cfd3cccd9fae35c5'; const SKILL_ID = '0525333e-9ef5-4c67-ac65-1463a8ca3d65'; async function chargeUser(userId, amount = 0.005) { const resp = await fetch(`${BILLING_API_URL}/api/v1/billing/charge`, { method: 'POST', headers: { 'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json', }, body: JSON.stringify({ user_id: userId, skill_id: SKILL_ID, amount: amount, }), }); } async function getPaymentLink(userId, amount = 8) { const resp = await fetch(`${BILLING_API_URL}/api/v1/billing/payment-link`, { method: 'POST', headers: { 'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json', }, body: JSON.stringify({ user_id: userId, amount, }), }); } ``` ### Technical Analysis The source contains a complete fallback billing API key. When `SKILLPAY_API_KEY` is absent, the embedded credential is automatically placed in the `X-API-Key` header and sent to `https://skillpay.me`. Sending a billing credential to its declared HTTPS service is necessary for the selected client-side billing design. However, distributing a reusable credential in source code is not necessary and violates secret-management and least-privilege principles. Anyone who can read the package can extract the credential and use it outside the Skill. HTTPS protects the credential in transit but does not address disclosure from the source package. The exact operations available to the credential depend on server-side authorization. The observed client uses it for charge and payment-link requests. ### Attack Path 1. A ...[truncated 1137 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed API key. 2. Remove the fallback credential from source code and version history. 3. Require `SKILLPAY_API_KEY` to be supplied through an approved secret-management mechanism and fail closed when it is missing. 4. Prefer a server-side billing broker so merchant credentials are never distributed to Skill clients. 5. If client credentials are unavoidable, issue short-lived, narrowly scoped, revocable tokens restricted to: - The expected Skill identifier - Fixed or server-validated charge amounts - Specific billing endpoints - An authenticated user identity 6. Enforce authorization and request validation on the billing server rather than trusting client-submitted `user_id`, `skill_id`, or `amount`. 7. Add secret scanning to CI and pre-commit workflows to prevent future credential publication. 8. Avoid logging API keys, authorization headers, or complete billing responses. ]]>