T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:88
- Finding
- API Key Exposure Through Console Output and Conversation Logs## Vulnerability Details **File Location**: `SKILL.md`, lines 88–92 **Vulnerability Type**: Secret exposure through insecure credential handling **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash ### Reading API Key ```bash echo $YYCLAW_API_KEY ``` If not set, ask the user to provide it or direct them to https://crypto.yyclaw.cc to get one. ``` ### Technical Analysis The skill explicitly instructs the agent to print `YYCLAW_API_KEY`. Printing a secret is not necessary to determine whether the variable is configured. The resulting value may be retained in terminal output, agent transcripts, execution logs, monitoring systems, or debugging records. The fallback instruction to ask the user to provide the key can also cause the credential to be entered directly into a conversation. Such conversations may be stored or made accessible to systems and personnel that do not require access to the credential. This violates least-exposure principles for secret handling. Although sending the key in an authorization header to the declared YYClaw API is necessary for authenticated operations, displaying it or accepting it through ordinary conversational input is not necessary. ### Attack Path 1. A user invokes the YYClaw skill without the agent first confirming whether the environment variable is safely configured. 2. The agent follows `SKILL.md` and executes `echo $YYCLAW_API_KEY`, or asks the user to provide the key in the conversation. 3. The plaintext API key appears in terminal output, an agent transcript, or associated logs. 4. A person or system with access to those records obtains the credential. 5. The exposed key is replayed against the YYClaw API to perform authenticated operations. ### Impact Assessment Successful exploitation could allow unauthorized use of paid model calls and access to API-key-scoped account information, including balance, remaining credit, wallet address, spending information, and ...[truncated 450 chars]
- Remediation
- ## Remediation Suggestions - Remove `echo $YYCLAW_API_KEY` and never display the credential. - Check only whether the variable exists, without revealing its value: ```bash if [ -n "${YYCLAW_API_KEY:-}" ]; then echo "YYCLAW_API_KEY is configured" else echo "YYCLAW_API_KEY is not configured" fi ``` - Do not ask users to paste API keys into ordinary chat or command-line arguments. - Direct users to configure the key through a secret manager, protected environment configuration, or another private credential-entry mechanism. - Ensure application, proxy, and agent logs redact `Authorization` headers and values matching the `sk-yy-` key format. - Apply minimum necessary permissions, spending limits, expiration, rotation, and revocation controls to issued API keys. - Obtain explicit user approval before transmitting prompts containing confidential information to the third-party gateway.