T09 · Insecure Skill Coding Practices
Error
- Location
- index.js:11
- Finding
- Hardcoded Payment Merchant Credential Distributed in Source Code<![CDATA[ ## Vulnerability Details **File Location**: `index.js:11-18`, `index.js:147-159` **Vulnerability Type**: Hardcoded secret and insecure credential handling **Risk Level**: High ### Vulnerable Code ```javascript const CONFIG = { skillpay_api: 'https://api.skillpay.me/v1', merchant_key: process.env.SKILLPAY_MERCHANT_KEY || 'sk_91fff75ae2a7a71f8eceadcbcd816e24d57e58d9d04ccca45f0b3856af130aea', price_per_use: 0.002, currency: 'USDT', max_linkedin_length: 3000, default_tone: 'professional', sloan_agent_id: 'sloan' }; ``` The embedded credential is subsequently transmitted to the billing API: ```javascript async function processPayment() { try { const response = await axios.post(`${CONFIG.skillpay_api}/billing/charge`, { amount: CONFIG.price_per_use, currency: CONFIG.currency, merchant_key: CONFIG.merchant_key, description: 'LinkedIn post generation by Sloan' }, { headers: { 'Content-Type': 'application/json' }, timeout: 10000 }); ``` ### Technical Analysis The application contains a payment merchant key directly in distributed source code and uses it whenever `SKILLPAY_MERCHANT_KEY` is not configured. Source code and published packages are not appropriate secret-storage mechanisms because every user who downloads the package can retrieve the credential without executing the application. The key is used as an authorization-related value in requests to the SkillPay billing API. Its exact permissions cannot be determined from the repository, but any permissions granted to it become available to anyone who extracts it. HTTPS protects the key in transit but does not mitigate disclosure from the source package. Because the key has already been committed and distributed, removing it in a later release alone is insufficient; it must be treated as compromised and rotated. ### Attack Path 1. An attacker downloads or inspects the skill package. 2. The attacker reads `index.js` and e ...[truncated 913 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed merchant key. 2. Remove the embedded fallback credential from all source files, package releases, examples, and documentation. 3. Require `SKILLPAY_MERCHANT_KEY` to be supplied through protected runtime configuration and fail closed when it is absent: ```javascript const merchantKey = process.env.SKILLPAY_MERCHANT_KEY; if (!merchantKey) { throw new Error('SKILLPAY_MERCHANT_KEY is required'); } ``` 4. Prefer a server-side billing broker so merchant credentials are never distributed to untrusted client installations. 5. Use narrowly scoped, short-lived credentials where the payment provider supports them. 6. Add automated secret scanning to source-control and release pipelines. 7. Review provider logs for use of the disclosed key and investigate unexpected transactions. 8. Avoid placing credentials in command output, error messages, documentation, or client-side telemetry. ]]>