T09 · Insecure Skill Coding Practices
- Location
SKILL.md:16- Finding
Bearer API Key May Be Exposed Through Conversation History and Process Arguments
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:16-21andSKILL.md:49-53
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: MediumThe affected instructions include:
bash export SHAPER_API_KEY="shp_..." export SHAPER_WORKSPACE_SLUG="your-slug"text Or ask the user to provide it directly.The key is subsequently expanded into a command-line argument:
bash curl -s -X POST https://useshaper.com/mcp \ -H "Authorization: Bearer $SHAPER_API_KEY" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"get_active_work","arguments":{}},"id":1}'Technical Analysis
The Skill explicitly permits requesting the Shaper API key directly from the user. If supplied through a conversation, the bearer credential may be retained in chat history, agent traces, tool-call logs, telemetry, or debugging records.
Although storing a secret in an environment variable is preferable to hardcoding it, expanding that variable in a
curl -Hcommand places the resulting authorization header in the process argument vector. Depending on operating-system permissions and the execution environment, command-line arguments may be observable through process-inspection facilities or captured by shell, task-runner, or agent execution logs.Because the credential is a bearer token, possession may be sufficient to authenticate to the Shaper MCP endpoint without an additional proof of identity.
Attack Path
- A user follows the Skill instructions and either supplies the API key directly in the conversation or exports it into the agent's execution environment.
- The agent invokes the documented
curlcommand, expanding the key into the authorization-header argument. - The plaintext credential is retained in conversation or execution logs, or observed through process inspection by another principal with suitable local access.
- An a ...[truncated 820 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction permitting the agent to ask users to provide API keys directly in conversation.
- Require credentials to be provisioned through a protected secret manager, platform credential store, or authenticated MCP server configuration.
- Ensure secrets are injected only at execution time and are automatically redacted from conversation records, tool-call traces, telemetry, and error output.
- Avoid placing authorization headers containing expanded secrets directly in process arguments. Prefer a restricted configuration file created with owner-only permissions, an execution API that passes headers outside the command-line argument vector, or another secret-aware transport supported by the runtime.
- Disable shell tracing while handling credentials and verify that task runners do not log expanded commands.
- Apply least privilege to workspace API keys, rotate them regularly, and revoke them immediately after suspected disclosure.
- Add explicit instructions explaining how users can rotate a leaked key and audit workspace activity after an exposure.