T09 · Insecure Skill Coding Practices
- Location
references/api/services-other.md:100- Finding
Hardcoded API Key Exposed in a Plaintext HTTP URL
- Content
View full analysis
Vulnerability Details
File Location:
references/api/services-other.md:100
Vulnerability Type: Hardcoded credential and plaintext transmission
Risk Level: MediumVulnerable Code
javascript // Query live weather information. The cityName reference URL is: // http://restapi.amap.com/v3/config/district?level=city&sublevel=0&extensions=all&output=xml&key=d9fba2f3196b6a4419358693a2b0d9a9 amapWeather.getLive('Beijing');The original comment contains a credential-like, 32-character AMap API key directly in a URL and uses unencrypted HTTP.
Technical Analysis
API credentials must not be embedded in documentation, examples, generated source code, or URLs. A reader or AI agent may reproduce this reference URL in generated applications. Because the URL uses HTTP, the key and request parameters can also be observed or modified by parties with access to the network path.
URLs are routinely retained in source repositories, browser history, application telemetry, reverse-proxy logs, access logs, and monitoring systems. Consequently, placing a key in a URL substantially expands its exposure. Although the audit could not verify whether this historical key remains active, it must be treated as exposed until revoked or conclusively shown to be invalid.
Attack Path
- An agent or developer reads the weather-service example.
- The example URL is copied into generated code, documentation, or a browser.
- The embedded key is exposed through the project source, plaintext network traffic, browser history, or infrastructure logs.
- An attacker extracts the key.
- If the key remains active and lacks sufficient origin, IP, service, or quota restrictions, the attacker submits unauthorized AMap API requests with it.
Impact Assessment
Successful exploitation does not grant local operating-system privileges. Its scope is limited to the services and quotas authorized for the exposed AMa ...[truncated 231 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the embedded key and replace it with an unmistakable placeholder such as
YOUR_AMAP_API_KEY. - Revoke or rotate the exposed key through the AMap administrative console, even if it is believed to be an obsolete example.
- Replace the HTTP endpoint with HTTPS to protect requests in transit.
- Avoid placing secrets in URLs. Keep sensitive credentials in protected server-side environment variables or a secrets manager.
- Route credential-bearing requests through a hardened backend proxy when supported, ensuring that the secret is never delivered to browser code.
- Restrict replacement credentials by permitted API, origin or server IP, environment, and minimum required quota.
- Add automated secret scanning to documentation and source-control workflows.
- Review repository history, generated artifacts, browser-accessible examples, and relevant logs for further copies of the exposed value.
- Remove the embedded key and replace it with an unmistakable placeholder such as