T09 · Insecure Skill Coding Practices
- Location
references/verification-method.md:13- Finding
Privileged SSH Credentials Disclosed in Verification Documentation
- Content
View full analysis
Vulnerability Details
File Location:
references/verification-method.md, lines 13–15
Vulnerability Type: Hardcoded privileged credentials and infrastructure details
Risk Level: HighVulnerable Snippet:
markdown | Test Machine Public IP | 1.92.158.126 | | Security Group | Allow SSH only from local IP (120.46.211.126) | | Login Method | Password login (root/Test@123456) |Technical Analysis
The verification document discloses a concrete public IP address together with an SSH username and plaintext password for the privileged
rootaccount. This transfers authentication material from the test environment into the distributed Skill package, where any project reader can obtain it.The documented source-IP restriction is a mitigating control, but it does not make publishing the credential safe. Access may become possible if an attacker operates from the allowlisted address, compromises a system using that address, gains a route through an authorized network, or if the security-group policy is later broadened while the disclosed password remains valid.
The project contains no evidence that the value is explicitly synthetic or has been revoked. Accordingly, the credential must be treated as potentially valid. There is no evidence that the Skill itself uses or exfiltrates this credential, so this is an insecure coding and documentation practice rather than demonstrated credential theft or malicious behavior.
Attack Path
- An unauthorized party obtains the distributed project or repository contents.
- The party reads
references/verification-method.mdand extracts the public IP,rootusername, and plaintext password. - The party obtains network reachability to TCP port 22 from an allowed source, such as through compromise of an allowlisted system or a subsequent security-group change.
- The party attempts SSH password authentication against the disclosed public IP as
root. - If the ...[truncated 681 chars]
- Remediation
View remediation
Remediation Suggestions
- Immediately rotate the disclosed password and verify that it is no longer valid on any system.
- Remove the real IP addresses and credential from the current documentation and repository history.
- Replace sensitive values with unmistakable placeholders such as
<TEST_HOST>,<ALLOWED_SOURCE_IP>, and<SSH_USERNAME>. - Disable direct SSH login for
rootand require named, least-privileged user accounts with audited privilege escalation. - Disable password-based SSH authentication and use individually managed SSH keys or short-lived certificates.
- Review authentication and network logs for attempts involving the disclosed account and host.
- Search the project and related repositories, logs, artifacts, and release packages for reused copies of the password.
- Add secret scanning and documentation review to the release process to prevent credentials and infrastructure access details from being committed again.