other
Error
- Location
- SKILL.md:69
- Finding
- Plaintext Credentials Disclosed to an External Vault Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:69-72`, `SKILL.md:201-204` **Vulnerability Type**: Plaintext credential disclosure to an external service **Risk Level**: Critical ### Vulnerable Code ```bash curl -s -X PUT "https://agentlair.dev/v1/vault/anthropic-key" \ -H "Authorization: Bearer $AGENTLAIR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"ciphertext": "sk-ant-YOUR-KEY-HERE", "metadata": {"label": "Anthropic API key", "service": "anthropic"}}' ``` The example session repeats the same behavior with a Stripe credential: ```bash curl -s -X PUT "https://agentlair.dev/v1/vault/stripe-live" \ -H "Authorization: Bearer $AGENTLAIR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"ciphertext": "sk_live_USER_PROVIDED_KEY", "metadata": {"label": "Stripe live key", "service": "stripe"}}' ``` ### Technical Analysis The default workflow sends user-provided third-party credentials to `https://agentlair.dev` as plaintext JSON protected only by transport-layer TLS. Although the request property is named `ciphertext`, the supplied value is not encrypted before transmission. The documented retrieval response also returns the same secret through both the `ciphertext` and `value` properties, demonstrating that the default storage workflow handles a recoverable plaintext value. Network access is intrinsic to a hosted vault, but granting the external service access to plaintext credentials is not the minimum privilege necessary. Mandatory client-side encryption could permit remote storage without allowing the service operator to recover the underlying credentials. The Skill encourages storage of credentials for high-impact services such as Stripe, Anthropic, OpenAI, and Slack. Consequently, compromise or malicious operation of the vault service could expose credentials spanning financial, communications, and cloud-service accounts. ### Attack Path 1. A user gives the agent a third-party API key or token. 2. The Skill ins ...[truncated 1221 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not upload plaintext credentials to the hosted vault. - Make client-side authenticated encryption mandatory rather than optional. - Use a modern authenticated-encryption construction such as AES-GCM or XChaCha20-Poly1305. - Keep encryption and key-encryption keys outside AgentLair and ensure the remote service cannot recover them. - Obtain explicit, informed user authorization before transmitting each credential to a third-party custodian. - Clearly disclose the service's trust boundary, plaintext-access model, retention behavior, breach implications, and account-recovery risks. - Apply per-secret or per-service authorization instead of allowing one bearer token to retrieve every credential in an account. - Support narrowly scoped, short-lived access tokens and immediate revocation. - Avoid printing secret-bearing responses and ensure command output, shell history, process arguments, and agent transcripts do not retain plaintext values. - Document and independently verify server-side controls, including access logging, encryption at rest, operator access restrictions, tenant isolation, and incident response. ]]>