T09 · Insecure Skill Coding Practices
- Location
scripts/skillpay.js:6- Finding
Hardcoded SkillPay Billing API Credential
- Content
View full analysis
Vulnerability Details
File Location:
scripts/skillpay.js:5-7, with credential use atscripts/skillpay.js:14-25andscripts/skillpay.js:33-41
Vulnerability Type: Hardcoded reusable API credential
Risk Level: HighVulnerable Code
js const BILLING_API_URL = 'https://skillpay.me'; const BILLING_API_KEY = process.env.SKILLPAY_API_KEY || 'sk_a267a27a1eb8381a762a9a6cdb1ea7d722f9f45f345b7319cfd3cccd9fae35c5'; const SKILL_ID = '31b2db37-8f69-41c4-b5c6-d9cab1d75dab';The credential is transmitted in billing requests:
js const resp = await fetch(`${BILLING_API_URL}/api/v1/billing/charge`, { method: 'POST', headers: { 'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json', }, body: JSON.stringify({ user_id: userId, skill_id: SKILL_ID, amount: amount, }), });It is also used to create payment links:
js const resp = await fetch(`${BILLING_API_URL}/api/v1/billing/payment-link`, { method: 'POST', headers: { 'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json', }, body: JSON.stringify({ user_id: userId, amount }), });Technical Analysis
The source code contains a complete, live-looking SkillPay API credential as a fallback whenever
SKILLPAY_API_KEYis not defined. This contradicts the manifest's declaration that the environment variable is required and causes the application to continue with a package-wide shared secret rather than failing securely.Because the Skill package must be distributed to users for execution, the fallback credential cannot remain confidential. Any party with access to the package can read the key without executing or reverse-engineering the application. The extracted key can then be supplied directly in the
X-API-Keyheader to SkillPay endpoints outside the intended program.Sending a runtime-provided credential to the declared billing service is necessary for the paid-service model. The excessive behavior is embedding a r ...[truncated 1572 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke and rotate the exposed credential immediately; removing it from future versions does not invalidate copies already distributed.
- Remove the fallback secret and fail closed when the environment variable is absent:
js const BILLING_API_KEY = process.env.SKILLPAY_API_KEY; if (!BILLING_API_KEY) { throw new Error('SKILLPAY_API_KEY is required'); }- Supply the replacement credential only through a managed runtime secret store or protected environment configuration.
- Restrict the replacement credential to the minimum required Skill ID, endpoints, operation types, charge amount, and request rate where supported.
- Do not grant administrative, refund, account-management, or unrelated billing permissions to a client-distributed credential.
- Prefer a server-mediated design in which the Skill receives a narrowly scoped, short-lived token rather than a persistent shared API key.
- Review SkillPay access and billing logs for use of the exposed key from unexpected clients, addresses, Skill IDs, amounts, or time periods.
- Add automated secret scanning to the release process and block publication when credential patterns are detected.