T09 · Insecure Skill Coding Practices
Warning
- Location
- README.md:11
- Finding
- WorldQuant Credentials Stored in an Unprotected Plaintext File## Vulnerability Details **File Location**: `README.md:11-13` **Additional Locations**: `SKILL.md:44-47`, `references/README_en.md:145-150` **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash # Configure credentials echo '["email", "password"]' > credential.txt ``` The equivalent instructions in `SKILL.md` are: ```bash # Create credential file echo '["your.email@worldquant.com", "your_password"]' > credential.txt ``` The reference documentation also directs users to create the following file: ```json ["your.email@worldquant.com", "your_password"] ``` ### Technical Analysis The documented setup procedure writes a WorldQuant email address and password directly into an unencrypted file. It does not instruct the user to restrict file permissions, exclude the file from source control, use a secret manager, or remove the file after use. The network use of these credentials for authentication with the WorldQuant platform is consistent with the Skill's declared simulation and submission functionality. No evidence was found that the credentials are deliberately transmitted to an unrelated third party. The vulnerability instead concerns excessive local exposure before the legitimate authentication request occurs. A plaintext credential file may be accessible to other local users or processes depending on the working directory and process umask. It can also be captured by source-control commits, backups, support bundles, container build contexts, or broadly mounted Docker volumes. ### Attack Path 1. A user follows the documented setup procedure and creates `credential.txt`. 2. The password remains stored as plaintext in the project directory. 3. The file is exposed through permissive filesystem permissions, a repository commit, a backup, a container build context, a shared volume, or another local process. 4. An attacker reads the email ...[truncated 791 chars]
- Remediation
- ## Remediation Suggestions 1. Do not instruct users to store account passwords directly in the project directory. 2. Prefer an operating-system credential store, a dedicated secret manager, or Docker secrets. 3. If file-based credentials are unavoidable: - Create the file with permissions limited to its owner, such as mode `0600`. - Store it outside the source tree. - Mount it read-only into the container. - Ensure it is never copied into an image layer. 4. Add `credential.txt` and equivalent secret files to `.gitignore` and `.dockerignore`. 5. Document credential rotation and immediate revocation procedures. 6. Avoid examples that place real secrets directly in shell commands, since shell history may retain the command. 7. Prefer short-lived tokens or narrowly scoped platform credentials if WorldQuant supports them.