T09 · Insecure Skill Coding Practices
- Location
SKILL.md:55- Finding
API Key Exposure Through Chat, Command Arguments, and Plaintext Configuration
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 55-85
Vulnerability Type: Insecure credential handling
Risk Level: MediumThe setup instructions tell the user to provide an API key to the agent and substitute it directly into either a shell command or plaintext JSON configuration.
Vulnerable Code
markdown 1. **Check for Claude Code** — If running inside Claude Code (check if `claude` CLI is available), run: ```bash claude mcp add outlit https://mcp.outlit.ai/mcp -- --header "Authorization: Bearer API_KEY" ``` 2. **Check for Cursor** — If `.cursor/mcp.json` exists in the project or home directory, add to that file: ```json { "mcpServers": { "outlit": { "url": "https://mcp.outlit.ai/mcp", "headers": { "Authorization": "Bearer API_KEY" } } } } ``` 3. **Check for Claude Desktop** — If `claude_desktop_config.json` exists at `~/Library/Application Support/Claude/` (macOS) or `%APPDATA%/Claude/` (Windows), add to that file: ```json { "mcpServers": { "outlit": { "url": "https://mcp.outlit.ai/mcp", "headers": { "Authorization": "Bearer API_KEY" } } } } ``` Ask the user for their API key if not provided. Replace `API_KEY` with the actual key.Technical Analysis
A bearer API key is a reusable authentication secret. Requesting it through an agent conversation can expose it to conversation retention, telemetry, logs, or other systems that process the transcript. Supplying it directly in a command may additionally expose it through shell history or process inspection. Persisting it literally in MCP JSON configuration leaves the secret accessible to any user, extension, backup process, or repository consumer able to read the file.
The instructions do not prescribe secret-store integration, environment-variable indirection, restrictive file perm ...[truncated 1463 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not ask users to paste API keys into agent conversations.
- Prefer an interactive, non-echoing authentication flow or an operating-system credential store.
- Where supported, reference an environment variable or secret-manager identifier from MCP configuration instead of storing the literal token.
- Avoid embedding secrets in command-line arguments because they may be retained in shell history or exposed through process inspection.
- Store credential-bearing configuration outside repositories and apply owner-only file permissions.
- Add explicit warnings against committing MCP configuration containing credentials.
- Redact authorization headers from logs, diagnostics, and support bundles.
- Instruct users to revoke and rotate any key previously disclosed in chat, logs, command history, or a shared configuration file.
- Issue narrowly scoped, revocable tokens with the shortest practical lifetime and minimum required permissions.