T09 · Insecure Skill Coding Practices
Error
- Location
- config.json:1
- Finding
- Plaintext PETKIT Account Credentials Included in the Project<![CDATA[ ## Vulnerability Details **File Location**: `config.json:1-4` **Vulnerability Type**: Hardcoded plaintext credentials **Risk Level**: High ### Vulnerable Code ```json { "username": "18055988330", "password": "[REDACTED LIVE-LOOKING PASSWORD]" } ``` The password value has been redacted from this report to prevent further disclosure. The audited file contains the complete plaintext value. ### Technical Analysis The project includes a phone-number username and a non-placeholder password directly in a tracked configuration file. Secrets stored in project files can be exposed through source repositories, skill packages, release archives, backups, logs, or file sharing. The application reads these values without any additional protection and submits them to the PETKIT client: ```python config = load_config() result = asyncio.run(get_petkit_status(config['username'], config['password'])) ``` Because the credentials appear usable rather than illustrative, possession of the project files may be sufficient to attempt authentication to the associated PETKIT account. ### Attack Path 1. An attacker obtains a copy of the project, repository, skill archive, backup, or build artifact. 2. The attacker opens `config.json`. 3. The attacker recovers the plaintext PETKIT username and password. 4. The attacker submits the credentials to the PETKIT service or compatible client. 5. If the credentials remain valid, the attacker can access data and devices associated with the account. ### Impact Assessment Successful exploitation could expose PETKIT account information and household device data, including linked feeders, litter boxes, water fountains, and purifiers. Depending on the capabilities exposed by the service and account, an attacker may also gain unauthorized control over linked devices. The documented behavior indicates that authentication may terminate the legitimate user's mobile application session, creating an additional account-availability im ...[truncated 97 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately rotate the exposed PETKIT password and invalidate existing sessions or tokens. 2. Remove the real credentials from the current project and all distributed artifacts. 3. Purge the secret from repository history rather than deleting only the latest version. 4. Add `config.json` to `.gitignore` and distribute a credential-free `config.example.json`. 5. Retrieve credentials from an operating-system credential store, dedicated secret manager, or protected environment variables. 6. Add automated secret scanning to development and release pipelines. 7. Review PETKIT account activity and linked devices for unauthorized access. 8. If plaintext fallback storage is unavoidable, restrict the file to the owning user with mode `0600`. ]]>