T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:541- Finding
MATON API Key Exposure Through Troubleshooting Command
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 541–545
Vulnerability Type: Sensitive credential disclosure
Risk Level: MediumVulnerable Code
markdown 1. Check that the `MATON_API_KEY` environment variable is set: ```bash echo $MATON_API_KEYtext ### Technical Analysis The troubleshooting procedure prints the complete `MATON_API_KEY` bearer credential to standard output. Although the key is not hardcoded in the project, displaying it violates secure secret-handling practices. Terminal output may be retained in agent transcripts, shell histories, CI logs, observability platforms, support records, or screen recordings. The Skill documents the same key as the bearer credential for both `gateway.maton.ai` and `ctrl.maton.ai`. Consequently, exposure of this value can provide access to Maton connection-management operations and proxied third-party APIs associated with the account. ### Attack Path 1. A user or operator encounters an authentication problem. 2. The agent follows the documented troubleshooting procedure. 3. The command `echo $MATON_API_KEY` writes the complete credential to captured terminal output. 4. An attacker or unauthorized operator with access to the transcript, logs, or monitoring output retrieves the key. 5. The attacker submits the key as a bearer credential to Maton control or gateway endpoints. 6. The attacker enumerates available connections and invokes operations allowed by the third-party OAuth grants associated with those connections. Exploitation therefore requires access to output containing the disclosed value. The project does not establish that such access already exists. ### Impact Assessment A disclosed key may allow an attacker to: - Enumerate Maton connections associated with the affected account. - Invoke supported third-party APIs through active OAuth connections. - Read, create, update, or delete third-party data where the correspon ...[truncated 498 chars]- Remediation
View remediation
Remediation Suggestions
Replace secret-printing instructions with a presence-only test:
bash if [ -n "${MATON_API_KEY:-}" ]; then echo "MATON_API_KEY is set" else echo "MATON_API_KEY is not set" fiAdditional hardening measures:
- Never print, log, interpolate into error messages, or include the complete key in diagnostic output.
- If identification is necessary, display only a short non-sensitive fingerprint generated locally rather than any reusable portion of the credential.
- Redact
Authorizationheaders and connection session tokens in logging and observability systems. - Mark the key as a masked secret in CI/CD and agent execution environments.
- Avoid shell tracing such as
set -xwhile handling the credential. - Rotate the key if it has previously appeared in retained terminal output, transcripts, or logs.
- Review stored logs and transcripts for historical disclosure and remove them according to the applicable retention policy.