T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/hifly_client.py:10
- Finding
- Hardcoded Shared Bearer Token Used as an Automatic Fallback<![CDATA[ ## Vulnerability Details **File Location**: `scripts/hifly_client.py:10-17` **Vulnerability Type**: Hardcoded credential **Risk Level**: Medium ### Vulnerable Code ```python DEFAULT_TOKEN = "2aeda3bcefac46a3" BASE_URL = "https://hfw-api.hifly.cc/api/v2/hifly" MEMORY_FILE = Path(__file__).parent / "memory.json" def get_token(): token = os.environ.get("HIFLY_API_TOKEN") if not token: token = DEFAULT_TOKEN print(f"Warning: Using default free-tier token ({DEFAULT_TOKEN}). Videos <30s only, watermarked.") return token ``` ### Technical Analysis The project embeds a reusable bearer token directly in its source code and automatically uses it whenever `HIFLY_API_TOKEN` is absent. The documentation identifies this as a limited demonstration token, but it is still an authentication credential accepted by the remote API. Anyone with access to the package can extract and use the token independently of the client. Automatic fallback also makes it easy for users to submit images, voice recordings, and text under a shared account without deliberately selecting that authentication context. Printing the complete token further exposes it to terminal logs, agent transcripts, and captured build output. Because the credential is public and shared, it cannot reliably identify individual callers or provide meaningful accountability. Revocation or exhaustion by one party can affect every installation relying on it. ### Attack Path 1. An attacker downloads the skill or examines its public source. 2. The attacker extracts `2aeda3bcefac46a3` from `DEFAULT_TOKEN`. 3. The attacker constructs requests to `https://hfw-api.hifly.cc/api/v2/hifly` with: ```http Authorization: Bearer 2aeda3bcefac46a3 ``` 4. The attacker invokes API operations supported by the token without using the distributed client. 5. Shared quota or service resources can be consumed, and abusive activity is attributed to the shared credential. 6. If the provider revok ...[truncated 702 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `DEFAULT_TOKEN` from the source and rotate or revoke the exposed credential. 2. Require `HIFLY_API_TOKEN` to be configured explicitly: ```python def get_token(): token = os.environ.get("HIFLY_API_TOKEN") if not token: raise RuntimeError( "HIFLY_API_TOKEN is required. Obtain a token from the service settings." ) return token ``` 3. If demonstration access is required, issue short-lived, narrowly scoped credentials through a controlled service rather than distributing a static token. 4. Apply server-side rate limits, operation restrictions, expiration, and per-user attribution to demonstration credentials. 5. Never print complete bearer tokens. Log only whether authentication was configured or, when necessary, a small redacted suffix. 6. Clearly notify users that media and text are uploaded to a third-party API before submission, especially for biometric images and voice samples. ]]>