T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:57- Finding
Plaintext Collection and Storage of User Credentials
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 57–81
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: HighVulnerable Code Snippet
markdown **Important**: User-provided credentials (passwords, API keys, tokens) are authorized for storage and should NOT be rejected. **If custom content contains sensitive information:** 1. Extract credentials (Gmail passwords, API keys, auth tokens, database passwords, etc.) 2. Create or append to `workspace-{agent-id}/scripts/.env` file in KEY=VALUE format 3. In AGENTS.md, reference these credentials using environment variable notation 4. Example: - User provides: "Gmail password: abc123" - Write to `scripts/.env`: `GMAIL_PASSWORD=abc123` - In AGENTS.md: "使用环境变量 `$GMAIL_PASSWORD` 进行Gmail认证" **Common sensitive fields to extract:** - Email passwords (Gmail, Outlook, SMTP, IMAP) - API keys (OpenAI, cloud services, third-party APIs) - Auth tokens (OAuth tokens, JWT, session tokens) - Database credentials (passwords, connection strings) - Secret keys (encryption keys, signing secrets) **Format for .env file:** ```text # Auto-generated by bot-customizer CREDENTIAL_NAME=credential_value API_KEY=your_api_key_heretext ### Technical Analysis The skill explicitly directs the agent to extract passwords, API keys, authentication tokens, database credentials, and cryptographic secrets from user input and persist them in a plaintext `.env` file. This handling is not required for the core task of merging customization instructions into `AGENTS.md`. No safeguards are specified for: - Owner-only filesystem permissions. - Encryption at rest. - Use of an operating-system keychain or managed secret store. - Exclusion of the `.env` file from source control and workspace sharing. - Redaction from logs, responses, backups, or diagnostics. - Validation of environment-variable names and values. - Secure rotation or deletion of stored credentials. Appending unvalidated values in `KEY= ...[truncated 1565 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the instruction to collect and persist credentials during agent customization.
- Keep
AGENTS.mdlimited to environment-variable references and require users to provision values separately. - Use an approved operating-system keychain or managed secret service when storage is essential.
- Require explicit, informed consent before any local secret storage.
- If a local secret file is unavoidable:
- Create it with owner-only permissions.
- Ensure parent directories are not broadly readable.
- Add it to applicable ignore and backup-exclusion rules.
- Never print or return its values.
- Avoid appending blindly; use atomic, permission-preserving writes.
- Validate variable names against a strict pattern such as
^[A-Z][A-Z0-9_]*$. - Encode or reject carriage returns, line feeds, null bytes, and other control characters in values to prevent entry injection.
- Document credential rotation, revocation, and secure deletion procedures.
- Minimize scope and lifetime by requesting restricted, short-lived tokens instead of account passwords or long-lived keys.
- Add validation that detects accidental secret inclusion in
AGENTS.md, logs, source-control changes, and completion messages.