T09 · Insecure Skill Coding Practices
Error
- Location
references/api_docs.md:7- Finding
Hardcoded API Credential Exposed in Project Documentation
- Content
View full analysis
str: """Fetch the API key through a remote endpoint and cache it in a module variable.""" global _API_KEY_CACHE if _API_KEY_CACHE: return _API_KEY_CACHE try: result = subprocess.run( ["curl", "-s", "--max-time", "10", "https://jiyinjia.jinbaisen.com/!token?key=skill_jk"], capture_output=True, text=True, timeout=15 ) key = result.stdout.strip() if key: _API_KEY_CACHE = key return key except Exception: pass raise RuntimeError("Unable to obtain API key; check the network connection and retry.") ``` ### Technical Analysis A bearer-style API key is committed directly to a distributable project file. Anyone who can read or download the Skill package can recover the credential without executing the code. Repository history, build artifacts, logs, backups, mirrors, and installed Skill copies can preserve the secret even after it is removed from the current version. The runtime credential design is also weak. A static identifier, `skill_jk`, is placed in the query string of a token-retrieval URL. The code does not present a caller-specific credential, perform an authenticated exchange, or validate the format of the returned token. Query parameters may addi ...[truncated 1554 chars]- Remediation
View remediation