T09 · Insecure Skill Coding Practices
- Location
rules/voiceover.md:14- Finding
Skill Instructs the Agent to Request a Raw API Credential
- Content
View full analysis
Vulnerability Details
File Location:
rules/voiceover.md:14-18
Vulnerability Type: Sensitive credential solicitation
Risk Level: MediumVulnerable Code Snippet
markdown By default this guide uses **ElevenLabs** as the TTS provider (`ELEVENLABS_API_KEY` environment variable). Users may substitute any TTS service that can produce an audio file. If the user has not specified a TTS provider, recommend ElevenLabs and ask for their API key. Ensure the environment variable is available when running the generation script:Technical Analysis
The Skill explicitly instructs the agent to ask the user for an ElevenLabs API key. A raw API credential should not be entered into an agent conversation because conversation content may be stored in chat history, observability systems, application logs, or retained context.
Soliciting the credential through chat is not required for the declared voiceover functionality. The generation code already obtains the credential from
process.env.ELEVENLABS_API_KEY, so the agent only needs to instruct the user to configure the environment variable locally. The credential is legitimately transmitted to the declared ElevenLabs endpoint by the example atrules/voiceover.md:31-37; the issue is the preceding instruction to disclose it to the agent.Attack Path
- A user requests AI-generated voiceover assistance.
- The agent loads
rules/voiceover.md. - Following the Skill instruction, the agent asks the user to provide an ElevenLabs API key.
- The user pastes the raw credential into the conversation.
- The credential becomes available to any chat-history, logging, tracing, retention, or support system that records the conversation.
- A party with unauthorized access to those records could reuse the key against the ElevenLabs API until it is revoked or expires.
Impact Assessment
Exposure may permit unauthorized use of the affected ElevenLabs accoun ...[truncated 444 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace the instruction to “ask for their API key” with an instruction never to request, display, or store the raw key in conversation.
-
Direct users to configure
ELEVENLABS_API_KEYlocally through an environment file excluded from version control, a CI/CD secret store, or an operating-system secret manager. -
Ask only for confirmation that the environment variable is configured, not for its value.
-
Add explicit guidance not to commit
.envfiles and to redact credentials from logs and error output. -
Validate that the variable exists before making the request, without printing it:
ts const apiKey = process.env.ELEVENLABS_API_KEY; if (!apiKey) { throw new Error( "ELEVENLABS_API_KEY is not configured. Set it locally without sharing its value.", ); } -
Use a restricted key with the minimum provider permissions and spending limits required for text-to-speech.
-
If a key has already been shared through chat, revoke and rotate it, then review provider usage records for unauthorized activity.
-