T09 · Insecure Skill Coding Practices
Error
- Location
- references/command-map.md:100
- Finding
- Authenticated API Key Enumeration Is Incorrectly Classified as Safe## Vulnerability Details **File Location**: `references/command-map.md`, line 100 **Vulnerability Type**: Sensitive credential disclosure through agent-visible command output **Risk Level**: High ### Vulnerable Code ```bash polymarket clob api-keys ``` The command appears under the section titled **“Read-only but wallet-aware”**, whose contents are presented as commands that may be run without the explicit confirmation required for sensitive operations. ### Technical Analysis The `polymarket clob api-keys` command enumerates API-key information associated with the locally configured Polymarket account. Although it may not modify account state, read-only behavior does not make credential-related output safe. Depending on the CLI response, the output could include API credentials, identifiers, secrets, passphrases, or other authentication metadata. Executing this command may cause the CLI to authenticate using credentials sourced from the local environment or Polymarket configuration. Its output then becomes visible to the agent and may be retained in tool results, conversation transcripts, application logs, telemetry, or debugging records. This exceeds the minimum privileges needed for ordinary market research and account-status inspection. The main skill states that authenticated read-only commands are allowed only when they do not reveal secrets. Classifying API-key enumeration as generally safe conflicts with that restriction and can lead the agent to expose credential material without informed user approval. ### Attack Path 1. A user or injected instruction asks the agent to inspect the configured Polymarket account or troubleshoot API access. 2. The agent consults `references/command-map.md`. 3. Because `polymarket clob api-keys` is listed in the read-only, wallet-aware section rather than the sensitive section, the agent runs it without explicit confirmation. 4. The CLI reads local authentication material and queri ...[truncated 1245 chars]
- Remediation
- ## Remediation Suggestions 1. Move `polymarket clob api-keys` from the read-only wallet-aware list into the sensitive-command section. 2. Require explicit, purpose-specific user confirmation immediately before executing any API-key enumeration command. 3. Prefer directing the user to run this command locally rather than allowing the agent to execute it. 4. Add an explicit rule that the agent must never reproduce API secrets, passphrases, private keys, bearer tokens, or complete authentication responses. 5. If execution is unavoidable, first verify the installed CLI version and documented output schema, then filter the output locally so only non-secret metadata—such as a redacted key identifier or creation date—is retained. 6. Avoid using generic JSON output for credential-management commands because structured output can make complete secrets easier to capture in logs. 7. Treat API-key creation, listing, and deletion as one sensitive credential-management group requiring confirmation and output redaction. 8. Add a post-execution check that prevents credential-like values from being included in assistant responses, transcripts, or diagnostic logs.