T09 · Insecure Skill Coding Practices
- Location
SKILL.md:66- Finding
Binance API Credentials Embedded in Persistent Cron Configuration
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 66-69
Vulnerability Type: Plaintext sensitive credentials in scheduled-task configuration
Risk Level: MediumVulnerable Code
text # Example: buy $50 BTC every Monday at 9am UTC 0 9 * * 1 BINANCE_API_KEY=... BINANCE_SECRET_KEY=... /path/to/dca.sh buy BTCUSDT 50Technical Analysis
The documented cron example instructs users to define Binance API credentials directly in a persistent crontab entry. Although the displayed values are placeholders rather than real credentials, following this pattern would store the actual API key and secret in plaintext within the user's cron configuration.
This contradicts the document's earlier instruction to never store credentials. Cron entries persist across sessions and may be exposed to privileged administrators, backup systems, configuration collection tools, diagnostic output, or any process that gains access to the affected user's crontab. Environment variables also do not provide secret-at-rest protection when their values are written directly into persistent configuration.
The scheduled command initiates an unattended cryptocurrency purchase. Consequently, disclosure of credentials with spot-trading permission could affect real financial assets.
Attack Path
- A user follows the documented example and replaces the placeholders with a genuine Binance API key and secret.
- The credentials are saved in the user's persistent crontab.
- An attacker or compromised administrative, backup, or diagnostic process obtains read access to that cron configuration.
- The attacker extracts the API key and secret.
- The attacker submits authenticated Binance API requests using the stolen credentials.
- Depending on the permissions and restrictions assigned to the key, the attacker queries account information or places unauthorized trades.
This path requires access to the stored cron configuration o ...[truncated 883 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not place API keys or secrets directly in crontab entries.
- Retrieve credentials at runtime from an operating-system credential store or dedicated secrets manager.
- If a protected local credentials file is unavoidable, restrict ownership to the service account and permissions to
0600, and load it through a tightly controlled wrapper script without printing its contents. - Use a dedicated Binance API key with only the minimum required permissions.
- Disable withdrawals for any key used by the DCA process.
- Apply Binance-supported source-IP allowlisting and rotate keys after suspected disclosure.
- Run and validate the workflow against Binance testnet before enabling real transactions.
- Add per-order and cumulative spending limits, duplicate-order protection, explicit response-status verification, and alerting for every executed or rejected order.
- Replace the insecure documentation example with a secret-manager-based invocation and clearly document credential rotation and revocation procedures.