T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:25
- Finding
- API Key Disclosed Through Verification and Troubleshooting Commands<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25-29`; additional instances in `rules/setup.md:45-50`, `rules/setup.md:56-59`, and `rules/setup.md:88-91` **Vulnerability Type**: Credential exposure through terminal output **Risk Level**: High ### Vulnerable Code `SKILL.md:25-29`: ```markdown `GEMINI_API_KEY` must be set in the environment. Verify with: ```bash echo $GEMINI_API_KEY ``` ``` `rules/setup.md:45-50`: ```markdown ### Step 3: Verify ```bash echo $GEMINI_API_KEY ``` A non-empty string confirms the key is set. nano-banana-2 never prints the full key value in command output. ``` `rules/setup.md:56-59`: ```bash source ~/.zshrc echo $GEMINI_API_KEY ``` `rules/setup.md:88-91`: ```markdown Check for extra spaces or newline characters in the key. Inspect safely: ```bash python3 -c "import os; k=os.environ.get('GEMINI_API_KEY',''); print('len:', len(k), 'first8:', repr(k[:8]))" ``` ``` ### Technical Analysis The command `echo $GEMINI_API_KEY` prints the complete authentication secret to standard output. This output can be retained in agent transcripts, CI logs, terminal recordings, debugging systems, or other monitoring infrastructure. The behavior directly contradicts the nearby assertion that the Skill never prints the full key. The troubleshooting command discloses the first eight characters of the key. Although this is not the complete credential, exposing any secret prefix is unnecessary and can facilitate credential identification, correlation, or accidental leakage. This flaw is especially relevant in an AI Agent environment because command output may be copied into the model's context or persisted by the orchestration platform. ### Attack Path 1. A user or Agent follows the documented setup or troubleshooting workflow. 2. `GEMINI_API_KEY` is already present in the process environment. 3. The verification command expands and prints the full key, or the troubleshooting command prints its first eight characters. 4. The o ...[truncated 726 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace all secret-printing verification commands with a boolean check: ```bash if [ -n "${GEMINI_API_KEY:-}" ]; then echo "GEMINI_API_KEY is set" else echo "GEMINI_API_KEY is not set" fi ``` 2. For troubleshooting, report only non-sensitive metadata such as whether the variable exists and its length: ```bash python3 -c "import os; k=os.environ.get('GEMINI_API_KEY'); print('set:', bool(k), 'length:', len(k) if k else 0)" ``` 3. Do not print even a partial key prefix. Remove the conflicting recommendation from `rules/security.md` that permits displaying the first few characters. 4. Correct the inaccurate statement that the Skill never prints the full key. 5. Ensure logs and Agent transcripts apply automatic secret redaction as defense in depth. 6. If the documented commands have already been executed in a logged environment, remove the secret from retained logs where possible and rotate the affected API key. ]]>