T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:104
- Finding
- Bearer Token Stored Insecurely and Exposed in Registration Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:104-121` **Vulnerability Type**: Plaintext credential storage and sensitive output exposure **Risk Level**: High ### Vulnerable Excerpt The following is a faithful English translation of the complete security-relevant excerpt: ```text Immediately save your accessToken! All your requests require it. Recommended: Save your credentials to ~/.config/siliconworld/credentials.json: ``` ```json { "agentDID": "did:silicon:agent:0x...", "accessToken": "eyJhbGciOiJIUzI1NiIs...", "agent_name": "Your Agent name" } ``` ```text This allows you to find your credentials later. You may also save them in your memory, an environment variable (SILICONWORLD_ACCESS_TOKEN), or anywhere you store secrets. Critical output instruction: When displaying registration results to the user, the complete JSON block above must be output. - Do not truncate claimLink or replace it with "...". - Do not attempt to extract only the URL. - Output the raw JSON response directly. ``` ### Technical Analysis The Skill handles a reusable bearer token without defining an adequately protected storage mechanism. It recommends a predictable plaintext path, `~/.config/siliconworld/credentials.json`, but does not require restrictive file permissions, ownership validation, encryption, or use of an operating-system credential manager. The alternative recommendation to store the token in Agent memory further expands its exposure. Persistent memory may be included in later prompts, inspected by other skills, synchronized externally, or retained in conversation and diagnostic records. The output instruction is particularly hazardous because the registration response shown earlier in the document contains both `claimLink` and `accessToken`. Requiring the complete raw JSON response to be displayed can disclose the bearer token through: - Conversation history - User-interface rendering - Agent execution logs - Telemetry and debugging sys ...[truncated 1671 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to display the complete registration response. 2. Extract and display only non-secret fields such as `claimLink`, `agentDID`, and registration status. 3. Redact the token consistently, for example: ```json { "agentDID": "did:silicon:agent:0x...", "claimLink": "https://siliconworld.io/claim/example", "accessToken": "[REDACTED]" } ``` 4. Do not place credentials in Agent memory, prompts, conversation history, or general-purpose logs. 5. Prefer an operating-system secret manager, such as Keychain, Secret Service, or Credential Manager. 6. If file storage is unavoidable: - Create the parent directory with mode `0700`. - Create the credential file with mode `0600`. - Validate ownership before reading or writing it. - Avoid following symbolic links. - Write atomically using a securely created temporary file. 7. Treat environment variables as a compatibility option rather than the preferred storage method because child processes and diagnostic tools may expose them. 8. Implement token expiration, rotation, revocation, and least-privilege scopes. 9. Ensure HTTP headers and response bodies containing tokens are excluded from telemetry and debug logs. 10. Warn users explicitly that the bearer token must never be pasted into chats, issue reports, or third-party tools. ]]>