T09 · Insecure Skill Coding Practices
- Location
analyze_stock.py:95- Finding
Hardcoded Finnhub API Credential Committed Across the Project
- Content
View full analysis
Vulnerability Details
File Location:
analyze_stock.py:95-101; additional occurrences atcompany_info.py:3,jd_logistics.py:4,report_v2.py:114,report_v3.py:109-110,stock_analyst.py:39, andtest_stock.py:5
Vulnerability Type: Hardcoded API credential and credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
python def get_us_stock(code): """获取美股行情""" FINNHUB_KEY = 'd6nucg1r01qse5qn5e90d6nucg1r01qse5qn5e9g' code = code.strip().upper() url = f'https://finnhub.io/api/v1/quote?symbol={code}&token={FINNHUB_KEY}' try: r = requests.get(url, timeout=10).json()The same credential is also used as an insecure fallback in the principal Skill implementation:
python FINNHUB_KEY = os.environ.get( 'FINNHUB_API_KEY', 'd6nucg1r01qse5qn5e90d6nucg1r01qse5qn5e9g' )Technical Analysis
A Finnhub API token is embedded directly in seven source files. Any person or automated system with read access to the project, a source archive, a fork, or repository history can recover and reuse the credential without running the Skill.
The token is also inserted into URL query strings. Query parameters may be retained by HTTP client diagnostics, proxy logs, network-monitoring systems, exception reports, or upstream access logs. Using an environment variable in
stock_analyst.pydoes not resolve the issue because the exposed token remains the default value and is used whenever the environment variable is absent.Attack Path
- An attacker downloads, clones, or otherwise obtains read access to the project.
- The attacker searches the source for
token,FINNHUB_KEY, or the known Finnhub token format. - The committed token is extracted from any of the seven affected files.
- The attacker submits requests to Finnhub while authenticating with the exposed token.
- The attacker consumes the asso ...[truncated 688 chars]
- Remediation
View remediation
Remediation Suggestions
-
Revoke the exposed Finnhub token immediately and issue a replacement.
-
Remove every hardcoded occurrence from the current source tree.
-
Purge the token from repository history where feasible, recognizing that rotation remains mandatory even after history rewriting.
-
Require
FINNHUB_API_KEYto be supplied through an environment variable or an approved secret manager, with no embedded fallback:python FINNHUB_KEY = os.environ.get("FINNHUB_API_KEY") if not FINNHUB_KEY: raise RuntimeError("FINNHUB_API_KEY is required") -
Centralize credential loading in one module rather than duplicating it across scripts.
-
Avoid including credentials in diagnostic output and sanitize request URLs before logging.
-
Add secret scanning to local hooks and CI, and block future commits containing API tokens.
-
Review Finnhub account usage for unauthorized requests made with the exposed token.
-