T09 · Insecure Skill Coding Practices
- Location
skills/generate-poster/SKILL.md:340- Finding
API Key Exposure Through Predictable Temporary Files and Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
skills/generate-poster/SKILL.md:340-361
Additional Locations:skills/generate-poster/SKILL.md:423-446,506-528,589-611,671-735
Vulnerability Type: Plaintext credential exposure and unsafe temporary-file handling
Risk Level: MediumVulnerable Code Snippet
The following is an English rendering of the documented commands, preserving their security-relevant structure:
json { "secretKey": "YOUR_API_KEY" }powershell [System.IO.File]::WriteAllText( "payload_temp.json", '{"query":"Generate a product image","secretKey":"YOUR_API_KEY"}', [System.Text.UTF8Encoding]::new($false) )bash curl -X POST \ "https://www.flyelep.cn/prod-api/poster-design/api/v1/poster/generateAsync" \ -H "Content-Type: application/json; charset=utf-8" \ --max-time 120 \ --data-binary '{"query":"Generate a product image","secretKey":"YOUR_API_KEY"}'The same file also documents header-based authentication, but numerous examples continue to place the API key in the JSON body, including examples that write the body to
payload_temp.json.Technical Analysis
The skill accepts a user-provided Flyelep API credential and embeds it in plaintext JSON. On Windows, the documented workflow writes that JSON to a fixed, predictable filename in the current working directory. On macOS and Linux, some examples place the credential directly in the command line.
This creates several credential disclosure channels:
payload_temp.jsoncan remain on disk if the request fails, execution is interrupted, or cleanup is skipped.- The predictable filename can be read or replaced by another local process with access to the working directory.
- File permissions depend on the process environment and may allow other local users or services to read the file.
- Inline shell commands can be retained in shell history, terminal logs ...[truncated 1682 chars]
- Remediation
View remediation
Remediation Suggestions
- Require
secretKeyto be sent exclusively through the HTTPS request header. Remove it from every documented JSON body. - Do not interpolate credentials directly into shell commands. Use an HTTP client with protected secret input or an environment-to-header mechanism that does not print the value.
- Avoid writing credentials to temporary files. Payload files should contain only non-secret request data.
- If a secret-bearing temporary file is unavoidable:
- Use the operating system's secure temporary-file API.
- Generate an unpredictable filename.
- Create the file with owner-only permissions.
- Store it outside shared project directories.
- Delete it in guaranteed cleanup logic such as
finallyor a shell trap.
- Disable command echoing and redact the
secretKeyheader from Agent logs, HTTP debugging output, error reports, and telemetry. - Update all affected examples consistently so users are not encouraged to follow the less secure body-authentication pattern.
- Recommend immediate key rotation if a real key has already been used in these commands or written to a project directory.
- Require