T09 · Insecure Skill Coding Practices
Warning
- Location
- analyze_stock.py:93
- Finding
- Hardcoded Finnhub API Credential Exposed in Source Code## Vulnerability Details **File Location**: `analyze_stock.py:93-101`; additional occurrences in `company_info.py:3-6`, `jd_logistics.py:4-7`, `report_v2.py:112-120`, `stock_analyst.py:39,103-110`, and `test_stock.py:5-9` **Vulnerability Type**: Hardcoded API credential and credential transmission in URL query parameters **Risk Level**: Medium ### Vulnerable Code ```python def get_us_stock(code): """获取美股行情""" FINNHUB_KEY = 'd6nucg1r01qse5qn5e90d6nucg1r01qse5qn5e9g' code = code.strip().upper() url = f'https://finnhub.io/api/v1/quote?symbol={code}&token={FINNHUB_KEY}' try: r = requests.get(url, timeout=10).json() ``` The primary implementation also retains the exposed credential as a fallback: ```python FINNHUB_KEY = os.environ.get( 'FINNHUB_API_KEY', 'd6nucg1r01qse5qn5e90d6nucg1r01qse5qn5e9g' ) ``` ### Technical Analysis A live-looking Finnhub API token is embedded directly in multiple version-controlled Python files. Anyone able to read the package or its repository history can recover and reuse it without running the Skill. Although `stock_analyst.py` supports the `FINNHUB_API_KEY` environment variable, its hardcoded fallback defeats secure secret injection. Other implementations always use the embedded value. The token is also appended to request URLs. Query-string credentials can be recorded by application logs, HTTP client diagnostics, proxies, monitoring systems, or error reports. HTTPS protects the request in transit but does not prevent exposure at endpoints or in logs. ### Attack Path 1. An attacker downloads the public project or obtains a distributed copy. 2. The attacker searches the source for `FINNHUB_KEY` or `token=`. 3. The attacker extracts the embedded Finnhub token. 4. The attacker sends independent requests to Finnhub using that token. 5. The attacker consumes the associated quota, triggers rate limits, or uses any other ...[truncated 708 chars]
- Remediation
- ## Remediation Suggestions 1. Revoke and rotate the exposed Finnhub token immediately. 2. Remove the credential from every source and test file, including all hardcoded fallback values. 3. Purge the credential from repository history where operationally feasible. Rotation remains mandatory because history rewriting cannot invalidate existing copies. 4. Require `FINNHUB_API_KEY` to be supplied through a secret manager or environment variable and fail safely when it is absent: ```python FINNHUB_KEY = os.environ.get("FINNHUB_API_KEY") if not FINNHUB_KEY: raise RuntimeError("FINNHUB_API_KEY is required") ``` 5. Use Finnhub's recommended authorization mechanism. If query-parameter authentication is unavoidable, configure logging and monitoring systems to redact the `token` parameter. 6. Add automated secret scanning to pre-commit and CI workflows. 7. Apply a narrowly scoped API credential, quota alerts, rotation procedures, and usage monitoring.