T09 · Insecure Skill Coding Practices
- Location
SKILL.md:52- Finding
Hardcoded FastMoss Password and Insecure Credential-Rotation Metadata
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 52–56
Vulnerability Type: Hardcoded secret and insecure persistence of credential metadata
Risk Level: HighVulnerable Code Snippet
markdown ### 2. Login Handling If login is required: - Use the `FASTMOSS_ACCOUNT` and `FASTMOSS_PASSWORD` environment variables - Account format: numeric only, such as 11668461 - Password: aaa060 (changed every five days; the replacement date is recorded in memory)The snippet is an English rendering of the corresponding instructions in the audited file.
Technical Analysis
The Skill specifies the concrete password
aaa060directly in its documentation, despite also instructing the Agent to retrieve credentials from environment variables. Skill files may be distributed through repositories, package registries, logs, backups, or Agent context, so they are not suitable secret-storage locations.An attacker who obtains the Skill can extract the password without accessing the protected runtime environment. The documented numeric account format and example may also help identify or guess the corresponding account. Even if the password is rotated every five days, publishing it defeats the protection expected from rotation while it remains valid.
The instruction to record the password replacement date in Agent memory additionally persists security-sensitive credential lifecycle information beyond the report-generation task. The report only requires the current credential at authentication time; persistent rotation metadata is not necessary for its declared functionality. Although the instruction does not explicitly store the password itself in memory, rotation timing can help an attacker determine when a disclosed credential may be active.
Attack Path
- An attacker obtains or views the distributed
SKILL.mdfile. - The attacker extracts the plaintext password
aaa060, the numeric account-format informa ...[truncated 1317 chars]
- An attacker obtains or views the distributed
- Remediation
View remediation
Remediation Suggestions
-
Remove
aaa060and every other real or realistic password from the Skill documentation and repository history. -
Require
FASTMOSS_PASSWORDto be supplied exclusively through a protected runtime environment or dedicated secret manager. -
Do not place passwords in command-line arguments, generated reports, chat messages, logs, examples, or error output.
-
Revoke or rotate the exposed password immediately. Review FastMoss authentication and usage logs for unauthorized access attempts.
-
Remove the instruction to record credential replacement dates in Agent memory. Manage rotation through an external secret-management system with access controls and audit logging.
-
Grant the FastMoss account only the permissions required to read the ranking data needed for report generation.
-
Use a dedicated automation account rather than a personal or administrative account, where supported.
-
Add secret scanning to repository and Skill publication workflows to prevent future plaintext credentials from being committed or distributed.
-
Replace the login instructions with a non-sensitive form such as:
markdown If login is required, read `FASTMOSS_ACCOUNT` and `FASTMOSS_PASSWORD` from the protected runtime environment. Never persist, display, or log either value.
-