T09 · Insecure Skill Coding Practices
Error
- Location
- test-gen.mjs:3
- Finding
- Hard-Coded OpenRouter API Credential in Test Script<![CDATA[ ## Vulnerability Details **File Location**: `test-gen.mjs:3-12` **Vulnerability Type**: Plaintext hard-coded API credential **Risk Level**: High ### Vulnerable Code ```js import fetch from 'node-fetch'; const apiKey = "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"; async function generate() { console.log("Generating logo..."); try { const response = await fetch("https://openrouter.ai/api/v1/chat/completions", { method: "POST", headers: { "Authorization": `Bearer ${apiKey}`, ``` ### Technical Analysis A plausible OpenRouter API key is embedded directly in source code and subsequently used as a bearer credential. Anyone who can read the source package, a copied archive, a published repository, or its revision history can recover the key without authentication. Bearer credentials are sufficient for access without proof of possession beyond knowledge of the token. Removing the key only from the current file would also be insufficient if it has already entered repository history, package caches, logs, or distributed artifacts. ### Attack Path 1. An attacker downloads or otherwise gains read access to the project. 2. The attacker inspects `test-gen.mjs` and extracts the plaintext token from line 3. 3. The attacker supplies the token in an `Authorization: Bearer ...` header to OpenRouter. 4. If the token remains active, the attacker submits requests under the associated OpenRouter account. 5. The attacker can continue consuming the account's quota or credits until the key is revoked, expires, or is restricted. ### Impact Assessment The exposed token may permit unauthorized use of the associated OpenRouter account within the permissions and spending limits assigned to that key. Potential effects include: - Unauthorized API requests and credit consumption. - Quota exhaustion and service disruption for the legitimate owner. - Activity attribution to the victim's account. - Access to any API c ...[truncated 213 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Revoke the exposed key immediately through the OpenRouter account dashboard and issue a replacement. 2. Remove the credential from the current source and all repository history using an appropriate history-rewriting tool. 3. Load test credentials exclusively from environment variables or a managed secret store: ```js const apiKey = process.env.OPENROUTER_API_KEY; if (!apiKey) { throw new Error("OPENROUTER_API_KEY is required"); } ``` 4. Add local secret files such as `.env` to `.gitignore`; provide only a non-sensitive `.env.example`. 5. Enable pre-commit and continuous-integration secret scanning. 6. Apply spending limits, model restrictions, rotation policies, and least-privilege controls to replacement credentials. 7. Review OpenRouter usage records for unauthorized requests made with the exposed key. ]]>