T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:55
- Finding
- Plaintext Financial API Credentials in Agent-Readable Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 55–67 **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: High ### Vulnerable Code Snippet ```markdown 在 `TOOLS.md` 中添加以下配置： ```markdown ### Passive Income Tracker 支持的平台和 API Keys: - Gumroad: (API Key) - Patreon: (API Key) - YouTube: (API Key) - Amazon Associates: (API Key) - Teachable: (API Key) - Stripe: (API Key) - PayPal: (API Key) ``` ### Technical Analysis The skill instructs users to place credentials for seven financial platforms directly in a Markdown configuration file. It does not require environment variables, an operating-system keychain, a dedicated secret manager, restrictive file permissions, or secret redaction. Because `TOOLS.md` is agent-readable plaintext, credentials entered as instructed could be exposed through agent context, diagnostic output, logs, source-control commits, backups, or other local processes with access to the file. The statement at `SKILL.md:86` that sensitive financial data is encrypted does not explicitly cover API credentials, and the package contains no implementation demonstrating credential encryption. The README recommends read-only API keys, but the configuration instructions do not enforce scopes. The actual impact therefore depends on the privileges assigned to each user-provided key. ### Attack Path 1. A user follows the setup instructions in `SKILL.md`. 2. The user inserts live Gumroad, Patreon, YouTube, Amazon Associates, Teachable, Stripe, or PayPal API credentials into `TOOLS.md`. 3. The plaintext file is subsequently read by an agent or local process, included in logs or backups, or accidentally committed to source control. 4. An unauthorized party retrieves one or more exposed credentials. 5. The party authenticates to the corresponding platform API and performs operations allowed by each key's configured scopes. ### Impact Assessment Successful expl ...[truncated 549 chars]
- Remediation
- ## Remediation Suggestions - Do not store API credentials directly in `TOOLS.md` or any other agent-readable Markdown file. - Retrieve credentials from environment variables, an operating-system credential store, or a dedicated secret-management service. - Keep only non-sensitive secret identifiers or environment-variable names in configuration files. - Require least-privilege, read-only API scopes for every supported platform and document the exact required permissions. - Validate configured scopes where platform APIs permit inspection, and reject unnecessarily privileged credentials. - Apply restrictive filesystem permissions to any local credential material. - Redact secrets from prompts, command output, exception traces, telemetry, logs, generated reports, and backups. - Add secret-bearing files to source-control ignore rules and use automated secret scanning in development and release workflows. - Encrypt credentials at rest with keys stored separately from the encrypted data; document key generation, storage, rotation, and recovery procedures. - Provide credential revocation and rotation guidance for suspected exposure. - Replace the current configuration example with placeholders referencing secure secret sources, and add an explicit warning never to paste or commit live credentials into Markdown files.