T09 · Insecure Skill Coding Practices
- Location
index.js:2- Finding
Hard-Coded Billing API Credential
- Content
View full analysis
Vulnerability Details
File Location:
index.js:2
Vulnerability Type: Hard-coded secret in distributable source code
Risk Level: HighVulnerable Code
js const BILLING_API_KEY = 'sk_2842f59e03e64e418c15771b0928c3f94a1f1da73ae7e72adc8f483e9f6fe6b1';The credential is subsequently placed in the billing request header:
js const headers = { 'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json', };Technical Analysis
A live-format billing API key is embedded directly in a distributable JavaScript file. Anyone who can download, inspect, or otherwise access the Skill package can recover the credential without executing the code.
The credential is intended to authenticate requests to
https://skillpay.me. Although the billing function is not called by the current execution path, this does not protect the secret: disclosure occurs as soon as the source package is distributed. The actual permissions and server-side restrictions attached to the key cannot be determined from the reviewed files.Attack Path
- Obtain or download the Skill package.
- Open
index.jsand extract the API key from line 2. - Identify the billing host and request format from lines 1 and 6-19.
- Send independent requests to the billing service with the stolen value in the
X-API-Keyheader. - Abuse any operations permitted to that credential, subject to the billing service's server-side authorization controls.
Impact Assessment
An attacker may be able to impersonate the Skill when communicating with the billing API. Depending on the key's server-side scope, this could enable unauthorized billing operations, financial or quota abuse, access to associated API responses, and attribution of attacker-generated requests to the credential owner.
The source does not establish that the key grants administrative privileges or access to the local host. The practical impact is limited by the billing service's authorization, endpoint ...[truncated 46 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke and rotate the exposed API key immediately; removal from a later source revision does not invalidate copies already distributed.
- Remove all credentials from source code and repository history.
- Keep long-lived billing credentials in a server-side secret manager or protected runtime configuration that is unavailable to Skill consumers.
- Prefer a trusted backend proxy or short-lived, narrowly scoped tokens instead of distributing a shared billing credential to clients.
- Restrict tokens to the minimum required billing operation, skill identifier, amount range, and environment.
- Enforce server-side authorization so callers cannot select arbitrary users, skills, amounts, or privileged endpoints.
- Add rate limiting, replay protection, request auditing, anomaly detection, and rapid credential-revocation procedures.
- Add secret scanning to development and release pipelines to prevent future credential exposure.