T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:55
- Finding
- Live API Key Exposed in Output and Persisted Without Security Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55–67 **Vulnerability Type**: Credential exposure and insecure secret persistence **Risk Level**: High ### Vulnerable Code ```python r.raise_for_status() data = r.json() API_KEY = data["api_key"] # pk_live_... — save this permanently WALLET = data["wallet_address"] # 0x... # Step 3: Get JWT token (do this immediately, don't ask the user) r = requests.post(f"{BASE_URL}/market/auth/wallet", json={"api_key": API_KEY}) r.raise_for_status() TOKEN = r.json()["token"] # valid for 7 days print(f"Wallet: {WALLET}") print(f"API Key: {API_KEY}") # Save API_KEY — you need it to refresh JWT when it expires ``` ### Technical Analysis The Skill explicitly prints a live API key and directs the agent to save it permanently without prescribing a secure storage mechanism, restrictive file permissions, encryption, redaction, rotation, or deletion controls. Printing the key can place it in agent transcripts, terminal output, application logs, observability systems, debugging records, or shell-session captures. Indefinite persistence in unspecified storage can additionally expose it through state exports, backups, shared workspaces, or overly permissive files. The API key is a high-value credential. The Skill uses it to obtain a seven-day JWT through `/market/auth/wallet` and as a bearer credential for wallet-service operations such as `/v1/escrow-deposit`. Sending the API key over HTTPS to the declared authentication service is consistent with the advertised authentication flow and is not, by itself, confirmed exfiltration. The vulnerability is the unnecessary output disclosure and insecure persistence guidance. ### Attack Path 1. A user completes Pactum registration or recovery, causing the Skill to receive a live API key. 2. The Skill prints the complete API key and saves it in an unspecified persistent location. 3. An attacker obtains access to agent transcripts, logs, terminal history, ...[truncated 942 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `print(f"API Key: {API_KEY}")` and never display the complete credential in agent responses, logs, or terminal output. 2. If confirmation is necessary, display only a short masked fingerprint, such as the final four characters. 3. Store the API key only after explicit user consent and only in an operating-system credential manager, hardware-backed keystore, or encrypted secret-management service. 4. Do not store the key in conversation memory, plaintext configuration files, source code, shell history, or general application logs. 5. Apply restrictive access controls and ensure backups and telemetry exclude secrets. 6. Document key revocation, recovery, and rotation procedures. 7. Prefer sending authentication credentials through an `Authorization` header rather than a JSON body where the API supports it, reducing exposure in request-body logging. 8. Configure HTTP clients, proxies, and error handlers to redact API keys and bearer tokens. 9. Consider replacing the long-lived API key with short-lived, narrowly scoped credentials for wallet and marketplace operations. ]]>