T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/search-gold.mjs:51
- Finding
- Hard-Coded Shared Tavily API Credential## Vulnerability Details **File Location**: `scripts/search-gold.mjs`, lines 51–53 **Vulnerability Type**: Hard-coded API secret / plaintext sensitive credential **Risk Level**: High ### Vulnerable Code ```js const DEFAULT_API_KEY = "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"; const apiKey = (process.env.TAVILY_API_KEY ?? DEFAULT_API_KEY).trim(); ``` The related documentation in `SKILL.md`, lines 15–21, explicitly advertises the embedded credential as a fallback: ```md **Optional environment variable:** - `TAVILY_API_KEY` - Tavily API key (optional; the built-in default key is used when unset) > A default API key is built in as a fallback. ``` ### Technical Analysis A live-looking Tavily API credential is stored directly in the distributed source code and is automatically selected whenever `TAVILY_API_KEY` is not configured. Secrets embedded in a Skill package cannot be kept confidential because every user or attacker with access to the package can inspect and extract them. The fallback also causes separate installations to share one credential, eliminating effective per-user isolation and attribution. No source-code exploit is required: possession of the package is sufficient to recover the token and use it independently of the Skill. ### Attack Path 1. An attacker downloads or otherwise obtains the Skill package. 2. The attacker opens `scripts/search-gold.mjs` and extracts the token assigned to `DEFAULT_API_KEY`. 3. The attacker submits arbitrary requests directly to the Tavily API using the extracted credential. 4. Requests are charged against, rate-limited under, or attributed to the credential owner. 5. Sustained use may consume the available quota, generate costs, trigger abuse controls, or cause the provider to revoke the credential. 6. Revocation can disrupt every legitimate installation that relies on the shared fallback token. ### Impact Assessment This issue grants unauthorized use of the Tavily API privileges associated ...[truncated 657 chars]
- Remediation
- ## Remediation Suggestions 1. Immediately revoke and rotate the exposed Tavily API credential. Removing it from the current source alone is insufficient because it may remain in distributed copies or repository history. 2. Delete `DEFAULT_API_KEY` and require callers to provide `TAVILY_API_KEY` through an approved secret-management mechanism. 3. Fail safely with a clear error when the environment variable is missing, for example: ```js const apiKey = process.env.TAVILY_API_KEY?.trim(); if (!apiKey) { console.error("Error: TAVILY_API_KEY is required."); process.exit(1); } ``` 4. Update `SKILL.md` and its metadata so that `TAVILY_API_KEY` is documented as mandatory rather than optional. 5. Store deployment credentials in a secret manager or protected runtime configuration, never in source code, examples, package artifacts, logs, or documentation. 6. Where supported by the provider, apply least-privilege scopes, account-level spending limits, restrictive quotas, key expiration, and usage alerts. 7. Review API access logs for unauthorized activity involving the exposed token and rotate any related credentials if compromise is suspected. 8. Add automated secret scanning to source-control and release pipelines to prevent future credential exposure.