T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:598- Finding
API Key Disclosure Through Troubleshooting Command
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 598–601
Vulnerability Type: API key exposure through terminal output
Risk Level: LowVulnerable code:
bash 1. Check that the `MATON_API_KEY` environment variable is set: ```bash echo $MATON_API_KEYtext ### Technical Analysis The troubleshooting procedure prints the complete `MATON_API_KEY` value rather than checking only whether the variable exists. Although this does not automatically transmit the credential over the network, terminal output is frequently retained in shell transcripts, CI/CD logs, agent execution records, screen recordings, and support captures. The key authenticates requests to the Maton gateway and connection-management service. Therefore, disclosing it can enable unauthorized use of the victim's Maton account and the third-party connections available through that account. The practical scope remains constrained by the services and permissions the user previously authorized. ### Attack Path 1. A user encounters an authentication problem and follows the documented troubleshooting procedure. 2. The user or an automated agent executes `echo $MATON_API_KEY`. 3. The complete secret appears in terminal output. 4. That output is retained in logs, captured by an agent, recorded, or shared with a support party. 5. An unauthorized observer extracts the key. 6. The observer submits the key as a bearer token to Maton's gateway or control API. 7. Subject to server-side restrictions and the victim's existing authorized connections, the observer can invoke connected APIs or inspect and manage connection records. ### Impact Assessment Successful exploitation may provide the ability to authenticate as the affected Maton account and access gateway functionality associated with its authorized connections. Potential consequences include reading third-party data, creating or modifying records, sending messages, and invoking destr ...[truncated 387 chars]- Remediation
View remediation
Remediation Suggestions
Replace secret-printing diagnostics with a presence-only test:
bash if [ -n "${MATON_API_KEY:-}" ]; then echo "MATON_API_KEY is set" else echo "MATON_API_KEY is not set" fiAdditional hardening measures:
- Never print, log, or interpolate the complete API key into diagnostic output.
- If identification is necessary, show only a short masked fingerprint generated by trusted tooling.
- Add explicit documentation warning users not to place the key in tickets, screenshots, chat messages, or CI logs.
- Ensure HTTP clients redact
Authorizationheaders from verbose and error logs. - Rotate the key immediately if it has appeared in retained or shared output.
- Prefer a dedicated authenticated health-check endpoint that confirms validity without returning credential material.