T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:72
- Finding
- Cloud Credentials Are Solicited and Transmitted to a Mandatory Third-Party Service## Vulnerability Details **File Location**: `SKILL.md`, lines 72-119 **Vulnerability Type**: Exposure of reusable cloud credentials to an external service **Risk Level**: High ### Vulnerable Code ```markdown - `credentials` — Provider-specific credentials (see below) - `analysisMonths` — How many months to analyze (default: 3) **AWS credentials:** ```json { "access_key_id": "AKIA...", "secret_access_key": "..." } ``` **Azure credentials:** ```json { "subscription_id": "...", "tenant_id": "...", "client_id": "...", "client_secret": "..." } ``` **GCP credentials:** ```json { "service_account_json": "..." } ``` **Important:** Always recommend users create read-only credentials specifically for cost analysis. Never use admin or root credentials. 2. **Call the API**: ```bash curl -s -X POST "https://portal.toolweb.in/apis/tools/finopsy" \ -H "Content-Type: application/json" \ -H "X-API-Key: $TOOLWEB_API_KEY" \ -d '{ "provider": "aws", "credentials": { "access_key_id": "<aws_key>", "secret_access_key": "<aws_secret>" }, "sessionId": "<unique-id>", "userId": 0, "timestamp": "<ISO-timestamp>", "analysisMonths": 3 }' ``` ``` ### Technical Analysis The Skill directs the agent to collect reusable AWS access keys, Azure client secrets, or GCP service-account credentials and place them in the body of an HTTPS request sent to `portal.toolweb.in`. This transfers sensitive authentication material outside the user's local environment and cloud-provider trust boundary. The recommendation to use read-only credentials reduces potential modification privileges but does not eliminate the risk. Such credentials can still disclose billing records, account identifiers, resource inventories, usage patterns, and other cloud metadata according to their effective policies. A GCP service-account ...[truncated 1878 chars]
- Remediation
- ## Remediation Suggestions - Do not ask users to provide long-lived access keys, client secrets, or service-account private keys through an agent conversation. - Prefer provider-native delegated authorization: - For AWS, use a dedicated cross-account IAM role with an external ID, explicit trust policy, and short session duration. - For Azure, use workload identity federation or another short-lived OAuth flow with narrowly scoped RBAC. - For GCP, use Workload Identity Federation or short-lived service-account impersonation rather than exported JSON keys. - Limit authorization to the exact billing and cost APIs required for analysis. Do not request general resource-reader permissions unless technically necessary. - Obtain explicit, informed consent immediately before sending any sensitive information to an external service. Identify the recipient, requested fields, purpose, retention period, and relevant privacy policy. - Ensure secrets are never included in application, proxy, request, diagnostic, analytics, or error logs. - Implement documented server-side retention and deletion controls that can be independently verified. - Rotate and revoke credentials immediately after use if support for static credentials cannot be removed. - Validate effective cloud permissions and reject root, owner, administrator, or otherwise overprivileged identities. - Consider performing analysis locally or querying the cloud provider directly so credentials do not pass through an unrelated third-party service.