T09 · Insecure Skill Coding Practices
- Location
README.md:63- Finding
Insecure Plaintext Storage and Disclosure of the Mobula API Key
- Content
View full analysis
Vulnerability Details
File Location:
README.md:63,README.md:192, andSKILL.md:184
Vulnerability Type: Plaintext sensitive-data storage and exposure
Risk Level: MediumVulnerable Code
README.md:63:bash echo 'export MOBULA_API_KEY="your_key"' >> ~/.zshrcREADME.md:192:bash echo $MOBULA_API_KEYSKILL.md:184:bash echo $MOBULA_API_KEYTechnical Analysis
The documentation recommends appending the Mobula API key directly to
~/.zshrc. This stores the credential as plaintext in a commonly readable and routinely backed-up configuration file. The key may be exposed to other processes operating under the user's account, local diagnostic tools, shell-configuration collectors, backups, or support bundles.The troubleshooting instructions also print the complete credential to standard output. This can disclose the key through terminal scrollback, screen sharing, screenshots, command transcripts, CI logs, remote-session recordings, or copied troubleshooting output.
Although the documented API is read-only and does not provide wallet or transaction-signing privileges,
MOBULA_API_KEYremains an authentication credential and should not be unnecessarily displayed or stored in an inadequately protected location.Attack Path
- A user follows the setup instructions and appends
MOBULA_API_KEYto~/.zshrc. - An attacker, malicious process, compromised user-level application, or exposed backup obtains the shell startup file.
- Alternatively, the user follows the troubleshooting instructions and prints the complete API key in a logged, shared, or recorded terminal session.
- The attacker extracts the credential from the shell file or terminal output.
- The attacker supplies the stolen value in the Mobula
Authorizationheader. - The attacker makes unauthorized API requests using the victim's account and consumes the victim's request quota until ...[truncated 666 chars]
- A user follows the setup instructions and appends
- Remediation
View remediation
Remediation Suggestions
-
Remove instructions that print the complete API key. Validate only whether the variable is present, for example:
bash if [ -n "${MOBULA_API_KEY:-}" ]; then echo "MOBULA_API_KEY is configured" else echo "MOBULA_API_KEY is not configured" fi -
If partial identification is necessary, display only a short redacted prefix or suffix and never the entire credential.
-
Prefer an operating-system credential manager, encrypted secret store, or runtime secret injection mechanism instead of storing the key in
~/.zshrc. -
If a local environment file must be supported, keep it outside version control and restrict its permissions:
bash install -m 600 /dev/null ~/.config/mobula.env -
Explicitly warn users not to commit the key, paste it into support requests, include it in screenshots, or expose it through logs.
-
Document key revocation and rotation procedures for users who may already have exposed the credential.
-
Recommend checking shell history, terminal logs, backups, and repository history after accidental disclosure.
-