T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:16
- Finding
- Bearer API Key May Be Exposed Through Conversation History and Process Arguments## Vulnerability Details **File Location**: `SKILL.md:16-21` and `SKILL.md:49-53` **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Medium The affected instructions include: ```bash export SHAPER_API_KEY="shp_..." export SHAPER_WORKSPACE_SLUG="your-slug" ``` ```text Or ask the user to provide it directly. ``` The key is subsequently expanded into a command-line argument: ```bash curl -s -X POST https://useshaper.com/mcp \ -H "Authorization: Bearer $SHAPER_API_KEY" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"get_active_work","arguments":{}},"id":1}' ``` ### Technical Analysis The Skill explicitly permits requesting the Shaper API key directly from the user. If supplied through a conversation, the bearer credential may be retained in chat history, agent traces, tool-call logs, telemetry, or debugging records. Although storing a secret in an environment variable is preferable to hardcoding it, expanding that variable in a `curl -H` command places the resulting authorization header in the process argument vector. Depending on operating-system permissions and the execution environment, command-line arguments may be observable through process-inspection facilities or captured by shell, task-runner, or agent execution logs. Because the credential is a bearer token, possession may be sufficient to authenticate to the Shaper MCP endpoint without an additional proof of identity. ### Attack Path 1. A user follows the Skill instructions and either supplies the API key directly in the conversation or exports it into the agent's execution environment. 2. The agent invokes the documented `curl` command, expanding the key into the authorization-header argument. 3. The plaintext credential is retained in conversation or execution logs, or observed through process inspection by another principal with suitable local access. 4. An a ...[truncated 820 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction permitting the agent to ask users to provide API keys directly in conversation. 2. Require credentials to be provisioned through a protected secret manager, platform credential store, or authenticated MCP server configuration. 3. Ensure secrets are injected only at execution time and are automatically redacted from conversation records, tool-call traces, telemetry, and error output. 4. Avoid placing authorization headers containing expanded secrets directly in process arguments. Prefer a restricted configuration file created with owner-only permissions, an execution API that passes headers outside the command-line argument vector, or another secret-aware transport supported by the runtime. 5. Disable shell tracing while handling credentials and verify that task runners do not log expanded commands. 6. Apply least privilege to workspace API keys, rotate them regularly, and revoke them immediately after suspected disclosure. 7. Add explicit instructions explaining how users can rotate a leaked key and audit workspace activity after an exposure.