T09 · Insecure Skill Coding Practices
Error
- Location
scripts/doc_processor_paid.py:31- Finding
Hard-Coded Billing API Credential Exposed in Source Code
- Content
View full analysis
float: """Query user balance.""" resp = requests.get( f"{BILLING_API_URL}/api/v1/billing/balance", params={"user_id": user_id}, headers={ 'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json' } ) data = resp.json() return data.get('balance', 0.0) ``` ### Technical Analysis The source package contains a static API key that is reused as the `X-API-Key` credential for the external SkillPay service. Secrets embedded in distributed source code cannot be protected: every user, package mirror, log collector, or malicious local process with read access to the package can recover the credential. The same credential is used by the balance, charge, and payment-link endpoints. No per-installation credential, user-bound token, request signature, or server-side proxy separates untrusted clients from the privileged billing API. Whether the exposed key can read or modify all billing records depends on its server-side scope. However, the code demonstrates that it is accepted for both read and state-changing billing operations, making exposure security-significant even if some authorization checks exist on the server. ### Attack Path 1. An attacker downloads or otherwise reads the Skill package. 2. The attacker extracts `BILLING_API_URL`, `BILLING_API_KEY`, and `SKILL_ID` from `scripts/doc_processor_paid.py`. 3. The attacker constructs reques ...[truncated 1045 chars]- Remediation
View remediation