T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:17- Finding
Privileged WordPress MCP bearer tokens are stored in plaintext
- Content
View full analysis
``` ``` The multi-site workflow repeats this practice: ```markdown Store multiple sites in `TOOLS.md` and select by name: ``` ### My Blog - **URL:** https://blog.example.com/wp-json/mcp/v1/http - **Token:** abc123 ### My Shop - **URL:** https://shop.example.com/wp-json/mcp/v1/http - **Token:** xyz789 ``` ``` ### Technical Analysis Bearer tokens are authentication credentials: possession is generally sufficient to authenticate to the associated MCP endpoint. Storing real tokens directly in `TOOLS.md` exposes them as plaintext to every user, process, extension, backup system, synchronization service, source-control operation, or AI context that can read that file. The instructions do not prescribe restrictive filesystem permissions, secret-manager integration, environment-variable indirection, token expiration, token scoping, log redaction, or source-control exclusions. Storing credentials for multiple sites in one file also increases the impact of a single disclosure. The exposed privileges depend on the server configuration. Core capabilities include content, media, taxonomy, user, and option operations. Opt-in capabilities may permit plugin or theme source modification, arbitrary SQL modification, WooCommerce order and customer access, social publishing, or raw WordPress REST operations. ### Attack Path 1. A user follows the documented setup and stores a valid WordPress MCP bearer token in `TOOLS.md`. 2. The file is exposed through an accidental repository commit, shared workspace, backup, synchronization ser ...[truncated 1440 chars]- Remediation
View remediation