T09 · Insecure Skill Coding Practices
Note
- Location
- SKILL.md:32
- Finding
- Persistent Plaintext Storage of GitHub Access Token## Vulnerability Details **File Location**: `SKILL.md`, lines 32-36 **Vulnerability Type**: Plaintext credential storage **Risk Level**: Low **Vulnerable Code Snippet**: ```bash # To add it permanently to ~/.zshrc: echo 'export GITHUB_TOKEN="your-token"' >> ~/.zshrc source ~/.zshrc ``` ### Technical Analysis The Skill recommends permanently storing a reusable GitHub access token as plaintext in the user's `~/.zshrc` file. Shell initialization files are not designed as credential stores and may be exposed through dotfile repositories, workstation backups, synchronization services, diagnostic archives, or other local processes and users with permission to read the file. Although the script sends the token only to the fixed HTTPS GitHub API endpoint and uses it for the declared repository-search functionality, persistent plaintext storage is not necessary. The unauthenticated API remains available at a lower rate limit, while authenticated access can use a secure credential provider or an ephemeral environment variable. ### Attack Path 1. A user follows the documented permanent configuration procedure and inserts a valid GitHub token into `~/.zshrc`. 2. The token remains stored in plaintext after the Skill finishes running. 3. An attacker or unintended data-processing system obtains read access to the file through local access, malware, a dotfile repository, backup extraction, configuration synchronization, or a support bundle. 4. The token is extracted and submitted to GitHub's API. 5. The attacker performs operations authorized by the token until it expires or is revoked. ### Impact Assessment Successful exploitation discloses the GitHub access token. The resulting privileges are limited to the repositories, organizations, and API operations granted by the token's configured scopes. A broadly scoped token could permit access to private repository metadata or modification of GitHub resources; a fine-grained ...[truncated 152 chars]
- Remediation
- ## Remediation Suggestions - Remove the recommendation to append the token to `~/.zshrc` or any other plaintext shell startup file. - Prefer GitHub CLI authentication, an operating-system credential store, or an approved secrets manager. - If an environment variable must be used, set it only for the process invocation or current shell session rather than persisting it. - Recommend a fine-grained GitHub token restricted to the minimum required read-only repository-search permissions, with a short expiration period. - Instruct users to rotate the token immediately if it was committed, synchronized, backed up insecurely, or otherwise disclosed. - Preserve the existing fixed HTTPS API destination and avoid logging or including the token in URLs, command output, or exception messages.