T09 · Insecure Skill Coding Practices
Warning
- Location
- ai_generator.py:91
- Finding
- Automatic Reuse and Cleartext Logging of External API Credentials## Vulnerability Details **File Location**: `ai_generator.py:91-101, 228-232` **Vulnerability Type**: Sensitive credential exposure and excessive credential access **Risk Level**: Medium ### Vulnerable Code ```python # 2. Read Claude Code configuration claude_settings_path = Path.home() / ".claude" / "settings.json" if claude_settings_path.exists(): try: with open(claude_settings_path, 'r', encoding='utf-8') as f: settings = json.load(f) env = settings.get('env', {}) if env.get('ANTHROPIC_AUTH_TOKEN'): return { 'api_key': env['ANTHROPIC_AUTH_TOKEN'], 'base_url': env.get('ANTHROPIC_BASE_URL'), 'model': env.get('ANTHROPIC_MODEL', 'glm-4-flash') } except (json.JSONDecodeError, KeyError): pass ``` ```python generator = AIQuestionGenerator() if generator.is_available(): print(f"API configuration: {generator.config}") print(f"Available model: {generator.config.get('model')}") ``` The configuration is subsequently supplied to the API client: ```python self.client = OpenAI( api_key=self.config['api_key'], base_url=self.config['base_url'] ) ``` ### Technical Analysis When the dedicated `BRAIN_TEASER_API_KEY` variable is absent, the Skill automatically reads `~/.claude/settings.json` and reuses `ANTHROPIC_AUTH_TOKEN`. This credential belongs to another application's configuration and is accessed without a separate, explicit opt-in for credential sharing. More critically, the module's executable test path prints the entire `generator.config` dictionary. Because that dictionary contains the unredacted `api_key`, directly executing `ai_generator.py` writes the credential to standard output. Standard output may be retained in shell history captures, CI logs, agent transcripts, debugging systems, or centralized logging infrastructure. The discovered cred ...[truncated 1709 chars]
- Remediation
- ## Remediation Suggestions 1. Remove automatic reuse of `ANTHROPIC_AUTH_TOKEN`. By default, accept only the Skill-specific `BRAIN_TEASER_API_KEY`. 2. If importing another application's credentials is required, place it behind an explicit configuration option and obtain clear user consent. 3. Never print the complete configuration dictionary. Log only non-sensitive fields and redact secrets, for example: ```python safe_config = { "base_url": generator.config.get("base_url"), "model": generator.config.get("model"), "api_key": "[REDACTED]" } print(f"API configuration: {safe_config}") ``` 4. Remove or isolate executable diagnostic code from production packages. 5. Permit only explicitly configured, trusted API endpoints and require HTTPS except for a clearly enabled loopback-only development mode. 6. Validate endpoint hostnames against an allowlist where deployments have a fixed provider. 7. Rotate any credential that may already have appeared in logs and purge affected logs according to the applicable retention policy.