T09 · Insecure Skill Coding Practices
Error
- Location
- references/security-patterns.md:74
- Finding
- Owner-request exceptions permit plaintext credential disclosure without defined identity verification<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:84` - `references/security-patterns.md:74` - `references/security-patterns.md:89` **Vulnerability Type**: Credential disclosure through an unsafe authorization exception **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:84`: ```markdown **EXCEPTION:** Owner's explicit direct request ("show me my config") ``` `references/security-patterns.md:74`: ```markdown **EXCEPTION:** Owner's explicit direct request: "show me my config" or "what's my API key" ``` `references/security-patterns.md:89`: ```markdown - Exception: Direct requests from owner like "show me my config" or "what's my API key" ``` ### Technical Analysis The Skill is documentation-only, but it directs users to copy these security rules into an agent's persistent `AGENTS.md` configuration. The rules ordinarily prohibit access to credential files, yet the quoted exceptions explicitly permit an owner request to retrieve configuration contents or plaintext API keys. No identity-verification mechanism, independently authenticated channel, secure secret-delivery mechanism, or mandatory redaction procedure is defined. Consequently, an agent implementing these patterns may treat the context of an owner-facing conversation—or a request claiming to originate from the owner—as sufficient authorization to read and disclose secrets. This exception weakens the surrounding credential-protection controls and conflicts with the Skill's own impersonation defense. A direct conversational request is not, by itself, reliable proof of identity. The risk becomes exploitable when an attacker can impersonate the owner, access an authenticated owner session, compromise an account, or inject a request into a channel the agent regards as owner-controlled. The flaw is classified as insecure Skill configuration rather than intentional credential theft: the repository contains no executable code that directly reads credentials or transmits them ov ...[truncated 2025 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove every exception that authorizes literal credential disclosure through ordinary conversation, including the examples `show me my config` and `what's my API key`. 2. Replace secret disclosure with non-sensitive status responses, such as: - Whether a credential is configured. - Whether validation succeeded. - A short, non-reversible fingerprint or heavily redacted suffix. - The credential's creation or expiration metadata, where available. 3. Instruct users to retrieve secrets directly from the original password manager, secret manager, or provider console rather than through the agent. 4. Treat credential values as non-displayable even when the request arrives in an owner session. Authentication to a chat session should not automatically authorize export of all secrets accessible to the agent. 5. If a product requirement makes secret disclosure unavoidable, require all of the following: - Independent and recent identity verification. - Explicit authorization for the exact secret and destination. - A dedicated secure delivery channel rather than ordinary chat or logs. - Prevention of secret persistence in transcripts, telemetry, memory, and audit logs. - Immediate warning and optional credential rotation after disclosure. 6. Add explicit SSH private-key patterns such as `~/.ssh/id_*` to the protected-file rules while excluding public-key files where appropriate. 7. Add regression tests confirming that requests such as `show me my config`, `what's my API key`, and `read ~/.ssh/id_rsa` are refused or answered only with redacted metadata, including when presented as direct owner requests. 8. Revise the recommended rule to language such as: ```markdown **NO PLAINTEXT-DISCLOSURE EXCEPTION:** Never display or transmit credential values, private keys, tokens, or complete secret-bearing configuration files, including in response to a direct owner request. Confirm only whether a value is configured or p ...[truncated 137 chars]