T09 · Insecure Skill Coding Practices
- Location
MEGA_PROMPT.md:273- Finding
Environment-variable logging combined with mandatory Git commits may expose API credentials
- Content
View full analysis
Vulnerability Details
File Location:
MEGA_PROMPT.md:273-278,MEGA_PROMPT.md:309-315, andSKILL.md:89-91
Vulnerability Type: Potential plaintext credential disclosure through project logs and version control
Risk Level: MediumComplete Vulnerable Snippets
MEGA_PROMPT.md:273-278:bash export OPENAI_API_BASE="<大模型 API 基础路径>" export OPENAI_API_KEY="<大模型 API_KEY>" export OPENAI_MODEL_NAME="<默认大模型名称>" export KAGGLE_API_TOKEN="<KAGGLE_TOKEN>" export TAVILY_API_KEY="<TAVILY_KEY>"MEGA_PROMPT.md:309-315:text ### 环境记录 你必须在 PROGRESS.md 中记录每次环境配置的细节，包括： - 安装的库（requirements.txt） - 版本号 - 配置的环境变量 ### Git 版本控制 你应该将代码和论文草稿都放在 Git 仓库中，每个阶段结束后提交一次，记录提交信息。SKILL.md:89-91:text ## Final step After modifying this skill or creating paper-project files in the workspace, commit the changes with a clear git message.Technical Analysis
The example credentials are placeholders rather than live secrets. The vulnerability arises from the interaction of three instructions:
- The workflow expects sensitive API credentials to be configured as environment variables.
- It requires environment-configuration details to be recorded in
PROGRESS.mdwithout specifying that only variable names may be recorded or that values must be redacted. - It instructs the Agent to commit project changes to Git.
An Agent could reasonably interpret “record every environment configuration detail” as including environment-variable values. If live API keys or tokens are copied into
PROGRESS.md, the subsequent commit instruction places those credentials in repository history. Removing the values in a later commit would not remove them from earlier Git objects.No hard-coded live credential was found in the audited files. This is an insecure workflow design that can cause credential disclosure when the Skill is used with real credentials.
Attack Path
- A user configures live
OPENAI_API_KEY,KAGGLE_API_TOKEN, orTAVILY_API_KEYvalue ...[truncated 1311 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace the environment-recording instruction with an explicit redaction policy:
- Record only environment-variable names and whether they are configured.
- Never record values, partial values, hashes, or command output containing secrets.
- Use entries such as
OPENAI_API_KEY: configured; value not recorded.
-
Add secret-management requirements:
- Load secrets from an approved secret manager or an untracked
.envfile. - Provide a
.env.examplecontaining placeholders only. - Add
.env, credential files, local configuration files, and generated logs to.gitignore.
- Load secrets from an approved secret manager or an untracked
-
Harden the commit workflow:
- Require explicit user approval before creating a commit.
- Inspect staged changes with
git diff --cached. - Run a secret scanner such as Gitleaks, TruffleHog, or GitHub secret scanning before every commit.
- Abort the commit when token-like patterns are detected.
-
Add safe documentation examples:
text ## Environment log - OPENAI_API_KEY: configured; value intentionally omitted - KAGGLE_API_TOKEN: configured; value intentionally omitted - TAVILY_API_KEY: not configured- If exposure has already occurred:
- Revoke and rotate every affected credential immediately.
- Remove secrets from the working tree.
- Rewrite Git history using an appropriate history-cleaning tool.
- Force-update affected remotes where authorized.
- Notify collaborators to discard old clones and verify service audit logs for unauthorized use.
-