T09 · Insecure Skill Coding Practices
Error
- Location
README.md:242- Finding
Hardcoded MiniMax API Credential in Documentation
- Content
View full analysis
``` The original line contains a complete `sk-cp-` API credential. Its value is redacted from this report to prevent further disclosure. ### Technical Analysis The repository documentation embeds a complete MiniMax API key in a sample environment configuration. Documentation stored in source control is accessible to repository users, package consumers, mirrors, build systems, and potentially public search or indexing services. Environment-variable syntax does not protect a secret when the value itself is committed to a tracked file. Removing the line in a later commit would also be insufficient if the credential remains available in version-control history, cached artifacts, forks, or published packages. An attacker does not need to execute the skill to obtain this credential. Reading the repository is sufficient. ### Attack Path 1. An attacker obtains access to the repository, a published package, a mirror, or its commit history. 2. The attacker opens `README.md` and extracts the complete value assigned to `OPENSPACE_API_KEY`. 3. The attacker submits requests to the corresponding MiniMax API using the exposed credential. 4. Requests consume the credential owner's quota and may incur charges or trigger provider-side restrictions. 5. The attacker can continue using the credential until it is revoked, expires, or is otherwise disabled. ### Impact Assessment The exposed key may permit unauthorized access to the API account capabilities granted to that credential. The expected scope includes: - Unauthorized LLM API requests. - Consumption of account quota. - Potential billing or subscription abuse. - Service disruption through quota exhaustion or provider rate limiting. - Reputational or operational impact if abusive content is gene ...[truncated 205 chars]- Remediation
View remediation