T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:55
- Finding
- Hard-Coded Shared Governance API Credential## Vulnerability Details **File Location**: `SKILL.md`, lines 55-61 **Vulnerability Type**: Hard-coded shared credential **Risk Level**: Medium ```bash ## Public Experience Public key: `v19-e5d585e28439decc614f09f91c4caa8c` ```bash curl -s https://boat-atlas-spa-flexible.trycloudflare.com/governance/health \ -H "X-Governance-Key: v19-e5d585e28439decc614f09f91c4caa8c" ``` ``` ### Technical Analysis The Skill publishes a reusable governance API credential directly in its documentation. Although it is explicitly described as a public key, it is transmitted through an authentication-style `X-Governance-Key` header. No documented restrictions, expiration, request scope, rate limits, or per-user attribution controls are provided. Anyone with access to the Skill can copy the key and submit requests independently. A shared credential prevents the service operator from reliably distinguishing legitimate Skill users from abusive clients. If the key grants access to endpoints beyond the demonstrated health operation, the exposure may affect additional governance functions. ### Attack Path 1. An attacker obtains the key from the publicly distributed `SKILL.md`. 2. The attacker sends requests to the governance service with the disclosed value in the `X-Governance-Key` header. 3. Requests are attributed to the shared credential rather than an individual authorized user. 4. The attacker automates requests to consume service capacity, enumerate accessible endpoints, or invoke any other operations permitted to that key. 5. Revoking the shared key disrupts every legitimate consumer using the documented example. ### Impact Assessment This issue does not grant local system privileges or access to files on the user's machine. Its scope is limited to permissions assigned to the exposed governance key. Potential effects include unauthorized API usage, quota or capacity consumption, weak audit attribution, service impersonation, a ...[truncated 94 chars]
- Remediation
- ## Remediation Suggestions - Revoke or rotate the published key. - Do not embed reusable credentials in Skill documentation or source files. - Require each consumer to obtain an individual, revocable credential. - Store credentials in protected environment variables or an appropriate secrets manager. - Restrict credentials to the minimum necessary endpoints and operations. - Add expiration, rate limiting, per-client attribution, and automated abuse detection. - Clearly distinguish non-secret identifiers from authentication secrets. If this value is genuinely public and provides no authorization, replace the authentication-style header design with an unauthenticated public endpoint.