T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:296
- Finding
- Proposed Helper Function Exposes the API Key Through Standard Output## Vulnerability Details **File Location**: `SKILL.md:296-303` **Vulnerability Type**: Secret exposure through standard output **Risk Level**: Medium ### Vulnerable Code ```bash get_api_key() { python3 - "$CRED_FILE" << 'PY' import json, sys path = sys.argv[1] with open(path) as f: data = json.load(f) print(data.get("api_key", "")) PY } ``` ### Technical Analysis The optional helper function reads the Agent Republic API key from the credentials file and writes the raw secret to standard output. This conflicts with the Skill's own instruction not to print API keys into chat or logs. Returning a secret through standard output exposes it to terminal capture, automation logs, command substitution mistakes, debugging output, and wrappers that record subprocess output. Shell tracing or later extensions to the suggested script could increase this exposure. Although the helper is documentation rather than bundled executable code, the Skill explicitly proposes it as code that a human may create. Implementing it as shown would introduce the insecure behavior. ### Attack Path 1. A human creates the optional helper script from the documented example. 2. The user, agent, or another script directly invokes `get_api_key`, captures its output, or enables diagnostic logging. 3. The raw API key is recorded in a terminal transcript, CI log, agent output, or another locally accessible log. 4. A local observer or party with access to that output obtains the bearer token. 5. The party submits authenticated requests to Agent Republic using the exposed token. ### Impact Assessment Successful exploitation reveals the Agent Republic bearer token. An attacker could exercise the API permissions associated with that credential, including reading agent or bot information and attempting supported state-changing operations. The issue does not grant operating-system root privileges, and the affected scope is limited to the authority assigned to the compromised API key.
- Remediation
- ## Remediation Suggestions - Do not expose the API key through standard output. - Use a narrowly scoped HTTP client that reads the credentials file internally and immediately applies the key to the authorization header. - Ensure authorization headers and credential values are excluded from logs, diagnostics, errors, and agent-visible output. - Disable shell tracing around all secret-handling operations. - Avoid command-line arguments containing the key because they may be visible in process listings. - If an environment variable must be used, populate it only for the minimum required lifetime and unset it immediately afterward. - Update the documentation so its example is consistent with the stated prohibition against printing secrets.