T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:89
- Finding
- Hard-Coded RunningHub API Credential## Vulnerability Details **File Location**: `SKILL.md`, line 89 **Vulnerability Type**: Hard-coded secret / plaintext API credential **Risk Level**: High ### Vulnerable Code ```markdown ## API Key 已预配置：`7192bd7ed2654d1dbfa24ef0c8576705` ``` ### Technical Analysis The skill documentation embeds a credential-like 32-character value and explicitly identifies it as a preconfigured API key. Because `SKILL.md` is distributed with the skill, anyone who can read the package can recover and potentially reuse this credential. This practice also conflicts with the dependency declaration at line 117, which states that the RunningHub token should be supplied through the `RUNNINGHUB_API_KEY` environment variable. Embedding the value defeats secret isolation and prevents secure per-user credential management. The audit cannot verify whether the exposed value remains active or determine its exact permissions because no authenticated validation was performed. Nevertheless, publishing an API credential is a confirmed exposure requiring immediate rotation. ### Attack Path 1. An attacker obtains or reads the distributed skill package. 2. The attacker opens `SKILL.md` and extracts the API key from line 89. 3. The attacker submits requests to the RunningHub API using the exposed credential. 4. If the credential is active, requests execute against the associated account and consume its permissions, quota, and paid resources. 5. The attacker may continue using the credential until it is revoked, rotated, expired, or blocked by the provider. ### Impact Assessment If active, the credential may permit unauthorized use of the associated RunningHub workflows. Potential consequences include: - Consumption of paid image and video generation resources. - Exhaustion of API quotas or rate limits. - Unauthorized workflow execution under the credential owner's identity. - Financial charges to the associated account. - Reduced attribution and auditability because legitimate and unauthor ...[truncated 209 chars]
- Remediation
- ## Remediation Suggestions 1. Revoke and rotate the exposed API key immediately through the RunningHub account or credential-management interface. 2. Remove the plaintext credential from `SKILL.md` and all other project files. 3. Purge the credential from repository history, cached artifacts, release packages, logs, and documentation copies where feasible. 4. Require the credential to be supplied exclusively through the `RUNNINGHUB_API_KEY` environment variable or an approved secret manager. 5. Add startup validation that reports a missing environment variable without printing its value. 6. Ensure scripts never include API keys in command output, error messages, generated JSON, or logs. 7. Use separate credentials for development and production, applying minimum necessary permissions, quotas, expiration, and provider-side restrictions. 8. Add automated secret scanning to version-control hooks and CI pipelines to prevent recurrence. 9. Review provider access logs and billing history for unauthorized activity involving the exposed credential.