T09 · Insecure Skill Coding Practices
- Location
SKILL.md:180- Finding
API Key Solicitation Through Conversation History
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 180-187
Vulnerability Type: Exposure of authentication credentials through plaintext conversation input
Risk Level: MediumVulnerable Documentation Excerpt
The following is a faithful English rendering of the complete affected example:
markdown **Example Conversation 2: New-user guidance** **User**: I want to redact a file. **Agent**: To process your file securely, I need access to the BestCoffer AI Redaction Skill. No API key is currently configured. Do you have an API key? **User**: No. **Agent**: You can obtain one at https://apiconsole.bestcoffer.com.cn/. After obtaining an API key, return here and tell me your API key so I can redact the file for you. *(The user obtains a key and returns.)* **User**: I have registered. My API key is sk-123456. **Agent**: Thank you. Now upload the file that you want to redact.This workflow is also reinforced at
SKILL.md:121, where the instructions assume that the user enters an API key before uploading a file.Technical Analysis
The documented workflow explicitly directs users to paste an API key into the conversational interface. Authentication credentials entered into chat can become part of model context, application telemetry, conversation history, support exports, debugging logs, or other storage systems that are not intended to function as secret managers.
This instruction conflicts with the safer guidance at
SKILL.md:58-59, which states that marketplace deployments should use platform secrets or environment variables and should avoid asking users to paste API keys into chat. Because both instruction paths exist in the same Skill, an agent following the example or authentication workflow may choose the insecure path.No hardcoded credential or executable credential-exfiltration logic was identified. The vulnerability is the insecure collection and handling workflow prescribed by the ...[truncated 1336 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove every instruction and example that asks users to enter API keys into chat.
- Require API keys to be configured exclusively through the host platform's secret manager, protected Skill configuration, or environment-variable mechanism.
- Replace the affected example with instructions that direct the user to a secure configuration interface without requesting that the credential be returned in the conversation.
- Add an explicit runtime rule requiring the agent to reject or redact apparent API keys supplied in chat and direct the user to rotate any key already disclosed.
- Ensure logs, errors, command output, and returned objects never include credential values.
- Apply least-privilege scopes, expiration periods, usage limits, and rotation support to issued API keys.
- Add automated documentation checks that fail packaging when phrases requesting secrets in chat are detected.
- Reconcile the authentication instructions with the secure configuration guidance at
SKILL.md:58-59so that only one unambiguous secret-handling workflow remains.