T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:594
- Finding
- API Key Disclosure Through Troubleshooting Command## Vulnerability Details **File Location**: `SKILL.md`, lines 594–600 **Vulnerability Type**: Sensitive credential exposure through terminal output **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash ### Troubleshooting: API Key Issues 1. Check that the `MATON_API_KEY` environment variable is set: ```bash echo $MATON_API_KEY ``` ``` ### Technical Analysis The troubleshooting instructions print the complete value of `MATON_API_KEY` merely to determine whether the environment variable is configured. Revealing the credential is unnecessary for that diagnostic purpose. The exposed value may be retained in CI/CD output, terminal recordings, support transcripts, screenshots, screen-sharing sessions, or other logging and monitoring systems. Because the same key is used as a bearer credential for `gateway.maton.ai` and `ctrl.maton.ai`, anyone who obtains it may authenticate as the affected Maton account until the credential is revoked or rotated. The broader network behavior—sending the bearer key and API request data to Maton's gateway—is declared and necessary for the Skill's proxy functionality. The vulnerability is specifically the unnecessary display of the raw key. ### Attack Path 1. A user encounters an authentication problem and follows the documented troubleshooting procedure. 2. The user runs `echo $MATON_API_KEY`. 3. The complete bearer credential appears in terminal output. 4. The output is captured in a CI log, terminal recording, screenshot, support transcript, or screen-sharing session. 5. An attacker or unauthorized observer retrieves the exposed value. 6. The attacker supplies it in an `Authorization: Bearer` header to Maton's control or gateway endpoints. 7. Subject to the key's account permissions and active OAuth connections, the attacker enumerates or manages connections and invokes connected third-party APIs. ### Impact Assessment Successful exploitation may allow impersonation o ...[truncated 726 chars]
- Remediation
- ## Remediation Suggestions Replace the raw-value command with a presence check that never prints the secret: ```bash if [ -n "${MATON_API_KEY:-}" ]; then echo "MATON_API_KEY is set" else echo "MATON_API_KEY is not set" fi ``` Additional hardening measures: 1. Explicitly warn users never to print, log, paste, or include the key in screenshots and support tickets. 2. Recommend immediate revocation and rotation if a key has appeared in logs or other captured output. 3. Redact bearer credentials in application, proxy, CI/CD, and support logging systems. 4. Use minimum OAuth scopes for every connected service. 5. Use separate, narrowly scoped connections or credentials for sensitive services where supported. 6. Require confirmation before destructive or high-impact operations, including connection deletion and third-party write actions. 7. Avoid placing unrelated credentials or sensitive metadata in custom headers or request bodies forwarded through the gateway.