T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:57
- Finding
- Plaintext Collection and Storage of User Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 57–81 **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: High ### Vulnerable Code Snippet ```markdown **Important**: User-provided credentials (passwords, API keys, tokens) are authorized for storage and should NOT be rejected. **If custom content contains sensitive information:** 1. Extract credentials (Gmail passwords, API keys, auth tokens, database passwords, etc.) 2. Create or append to `workspace-{agent-id}/scripts/.env` file in KEY=VALUE format 3. In AGENTS.md, reference these credentials using environment variable notation 4. Example: - User provides: "Gmail password: abc123" - Write to `scripts/.env`: `GMAIL_PASSWORD=abc123` - In AGENTS.md: "使用环境变量 `$GMAIL_PASSWORD` 进行Gmail认证" **Common sensitive fields to extract:** - Email passwords (Gmail, Outlook, SMTP, IMAP) - API keys (OpenAI, cloud services, third-party APIs) - Auth tokens (OAuth tokens, JWT, session tokens) - Database credentials (passwords, connection strings) - Secret keys (encryption keys, signing secrets) **Format for .env file:** ```text # Auto-generated by bot-customizer CREDENTIAL_NAME=credential_value API_KEY=your_api_key_here ``` ``` ### Technical Analysis The skill explicitly directs the agent to extract passwords, API keys, authentication tokens, database credentials, and cryptographic secrets from user input and persist them in a plaintext `.env` file. This handling is not required for the core task of merging customization instructions into `AGENTS.md`. No safeguards are specified for: - Owner-only filesystem permissions. - Encryption at rest. - Use of an operating-system keychain or managed secret store. - Exclusion of the `.env` file from source control and workspace sharing. - Redaction from logs, responses, backups, or diagnostics. - Validation of environment-variable names and values. - Secure rotation or deletion of stored credentials. Appending unvalidated values in `KEY= ...[truncated 1565 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction to collect and persist credentials during agent customization. 2. Keep `AGENTS.md` limited to environment-variable references and require users to provision values separately. 3. Use an approved operating-system keychain or managed secret service when storage is essential. 4. Require explicit, informed consent before any local secret storage. 5. If a local secret file is unavoidable: - Create it with owner-only permissions. - Ensure parent directories are not broadly readable. - Add it to applicable ignore and backup-exclusion rules. - Never print or return its values. - Avoid appending blindly; use atomic, permission-preserving writes. 6. Validate variable names against a strict pattern such as `^[A-Z][A-Z0-9_]*$`. 7. Encode or reject carriage returns, line feeds, null bytes, and other control characters in values to prevent entry injection. 8. Document credential rotation, revocation, and secure deletion procedures. 9. Minimize scope and lifetime by requesting restricted, short-lived tokens instead of account passwords or long-lived keys. 10. Add validation that detects accidental secret inclusion in `AGENTS.md`, logs, source-control changes, and completion messages.