T09 · Insecure Skill Coding Practices
- Location
handler.py:5- Finding
Hard-Coded Groq API Credential Used as a Runtime Fallback
- Content
View full analysis
Vulnerability Details
File Location:
handler.py:5-7
Vulnerability Type: Hard-coded secret
Risk Level: HighVulnerable Code:
python def __init__(self): api_key = os.getenv("GROQ_API_KEY", "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") self.client = Groq(api_key=api_key)Technical Analysis
The code embeds a Groq API credential as the default value passed to
os.getenv. IfGROQ_API_KEYis absent, the application silently authenticates with the exposed credential. This contradictsconfig.json, which declares the environment variable as required.Secrets stored in source code are exposed to anyone who can download the skill, inspect source archives, read build artifacts, or access repository history. The key uses Groq's live credential format and must be treated as compromised regardless of whether it remains active.
Attack Path
- An attacker downloads or otherwise obtains the skill package.
- The attacker inspects
handler.py. - The attacker extracts the embedded Groq API key.
- The attacker submits requests directly to Groq using that credential.
- Requests consume the credential owner's quota and are attributed to the associated account until the key is revoked or disabled.
Impact Assessment
Successful exploitation does not directly grant host operating-system privileges, but it may grant unauthorized access to the Groq API permissions associated with the exposed key. An attacker could consume API quota, create billing or availability impact, and perform activity attributed to the credential owner. The scope is bounded by the permissions, quotas, and account controls attached to the key.
- Remediation
View remediation
Remediation Suggestions
- Revoke and rotate the exposed credential immediately; removing it from the current file is insufficient because it may remain in distributed copies and source history.
- Remove the fallback value and require the environment variable explicitly:
python api_key = os.environ["GROQ_API_KEY"] self.client = Groq(api_key=api_key) - Catch missing configuration at startup and return a sanitized configuration error without printing secrets.
- Store production credentials in an approved secret manager or protected deployment environment.
- Review Groq account logs, quota consumption, and billing for unauthorized use.
- Add automated secret scanning to source-control, build, and release pipelines.
- Where history exists, purge the credential from repository history while still treating the original key as permanently compromised.