T09 · Insecure Skill Coding Practices
- Location
SKILL.md:30- Finding
Persistent Storage of a Privileged Shopify Access Token in Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 30–45
Vulnerability Type: Plaintext credential collection and persistent storage
Risk Level: HighVulnerable Code Snippet
text ## Configuration (ask on first use if not set) Before running any workflow, check that the following are configured in memory. If missing, ask the user once and store in long-term memory: SHOPIFY_STORE_HANDLE # e.g. my-store (not the full URL) SHOPIFY_ACCESS_TOKEN # Admin API access token (starts with shpat_) SHOPIFY_API_VERSION # Default: 2025-01 (update annually) DEFAULT_VENDOR # Optional: store's default brand name DEFAULT_CURRENCY # Default: GBP DEFAULT_LANGUAGE # Default: en-GB DEFAULT_STATUS # Default: active (options: active | draft) SHOPIFY_LOCATION_ID # Fetched automatically on first inventory operation Store these securely in memory under the key `shopify_config`. Never log or repeat the access token back to the user.Supporting instructions also direct the user to submit the credential through a conversational channel:
text Set my Shopify config: Store: my-store-name Token: shpat_xxxxxxxxxxxxxxxxxxxx Vendor: My Brand NameThis supporting snippet appears in
CONFIG.md, lines 24–34.Technical Analysis
The Skill instructs users to disclose a privileged Shopify Admin API access token in chat and then copies it into long-term agent memory. Although it says to store the token “securely” and never repeat it, the project defines no concrete secret-storage control, such as encryption at rest, a secrets-manager reference, access restrictions, automatic redaction, expiration, rotation, or deletion.
Sending the token as an authentication header to Shopify is necessary for the declared functionality. The insecure behavior is collecting the raw token through conversation and retaining it in general-purpose long-term memory rather than a dedicated credential store.
The documentation-only project canno ...[truncated 1881 chars]
- Remediation
View remediation
Remediation Suggestions
-
Do not accept raw API tokens through chat. Replace conversational credential entry with a protected configuration interface or deployment-time secret injection.
-
Use a dedicated secrets manager. Store the token in an operating-system keychain, managed vault, or platform-native encrypted secret store. Long-term agent memory should contain only an opaque secret identifier.
-
Apply automatic redaction. Detect Shopify token patterns such as
shpat_...at input, telemetry, logging, error-reporting, transcript-export, and tool-output boundaries. -
Enforce destination validation. Before attaching the credential, construct the endpoint from a strictly validated store handle and require HTTPS with an exact Shopify-controlled hostname ending in
.myshopify.com. Reject user-controlled URLs, embedded credentials, ports, path separators, and hostname suffix tricks. -
Minimize Shopify scopes. Request only scopes required by enabled workflows. For example, do not grant collection or inventory write access if those features are disabled. Separate destructive product-management capabilities where the platform permits it.
-
Define credential lifecycle controls. Document token rotation, revocation, expiration where supported, secure removal, and incident-response procedures. Provide a command that deletes the secret from the credential store without exposing it.
-
Prevent credential disclosure. Ensure the token cannot appear in confirmations, generated URLs, exception messages, debug output, reports, model context beyond the authenticated request, or subsequent memory retrieval.
-
Correct the documentation. Remove unsupported assurances that memory storage is inherently secure or exclusively local. State the actual storage mechanism and its security boundaries.
-