T09 · Insecure Skill Coding Practices
- Location
config.json:2- Finding
Hardcoded Gateway Bearer Credential in Distributed Configuration
- Content
View full analysis
Vulnerability Details
File Location:
config.json, lines 2–3
Vulnerability Type: Hardcoded plaintext service credential
Risk Level: HighVulnerable Code
json { "SMARTLIB_GATEWAY_URL": "https://1318491188-jvmi3wist0.ap-shanghai.tencentscf.com", "SMARTLIB_GATEWAY_SECRET": "sk-O9vHwWzMg0Jf7khvhKQ0xxpdGIOROcw5RyQnROrNuZj9x6hOeHmi2", "SMARTLIB_EMAIL": null }Technical Analysis
The project distributes a plaintext Gateway bearer secret in
config.json. Any user or process with access to the Skill package can recover the credential without authentication.This is an operational credential rather than unused example data. The documented execution flow reads the secret from this file and places it in the
Authorization: Bearerheader for Gateway operations. Relevant uses include quota lookup atSKILL.md:101–102, token consumption atSKILL.md:176–178, and proxied search requests atSKILL.md:183–186andSKILL.md:513–514.The credential therefore crosses from a publisher-controlled backend trust domain into every environment where the Skill is distributed. Instructions not to reveal the secret in conversation do not protect it from users, local processes, package mirrors, source-control history, or anyone else able to inspect the package.
Attack Path
- An attacker downloads, installs, or otherwise obtains the Skill package.
- The attacker reads
config.jsonand extracts the Gateway URL and bearer secret. - Following the documented API flow, the attacker supplies the secret in the Gateway's
Authorization: Bearerheader. - The attacker invokes credential-protected Gateway operations such as quota lookup,
/consume, and/search, subject to whatever server-side restrictions are associated with the exposed credential. - The attacker can continue impersonating authorized Skill traffic until the credential is revoked or rotated.
This path requires no compromise of the ...[truncated 724 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke and rotate the exposed Gateway credential immediately.
- Remove the secret from the distributed package and purge it from source-control history, release archives, caches, and build artifacts.
- Keep only a placeholder in
config.example.json; do not place a functional shared credential inconfig.json. - Provision separate credentials through an authenticated enrollment process at installation or first use.
- Store credentials in a platform secret manager, protected keychain, or restricted runtime environment rather than a distributable content file.
- Apply least privilege, per-installation identity, short expiration, rate limits, and revocation support to Gateway credentials.
- Ensure the Gateway validates that the authenticated installation is authorized to act for the supplied account or email instead of relying on a shared bearer secret.
- Add automated secret scanning to source-control and release pipelines to prevent recurrence.