T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:43
- Finding
- API Credential Prefixes Are Exposed in Shell Output## Vulnerability Details **File Location**: `SKILL.md`, lines 43-46 **Vulnerability Type**: Partial secret disclosure through terminal and log output **Risk Level**: Medium ```bash Verify they're set: ```bash echo "Key: ${NYNE_API_KEY:0:8}... Secret: ${NYNE_API_SECRET:0:6}..." ``` ``` ### Technical Analysis The credential verification procedure prints the first eight characters of `NYNE_API_KEY` and the first six characters of `NYNE_API_SECRET`. Although these are not the complete credentials, secret prefixes remain sensitive authentication material. Shell output may be retained in CI logs, agent transcripts, terminal recording systems, support bundles, or centralized observability platforms. Revealing known prefixes reduces the unknown credential space and can assist credential correlation, targeted brute-force attempts, or identification of credentials exposed through another source. Sending the complete credentials to the declared Nyne HTTPS API in authentication headers is necessary for the skill's stated enrichment functionality. Printing credential fragments locally is not necessary and exceeds the minimum disclosure required to verify that the variables are configured. ### Attack Path 1. A user or automation system follows the setup instructions and executes the verification command. 2. The API key and secret prefixes are written to standard output. 3. The output is captured in an agent transcript, CI job log, terminal recording, or shared support artifact. 4. An attacker with access to that output obtains both credential prefixes. 5. The attacker correlates the prefixes with credentials from another leak or uses them to reduce the search space for weak or predictably generated credentials. 6. If the complete credentials are recovered, the attacker can authenticate to the Nyne API under the victim's account. ### Impact Assessment Direct execution privileges are not obtained from the prefixes alone. The ...[truncated 445 chars]
- Remediation
- ## Remediation Suggestions - Do not print any portion of either credential. - Verify only whether each variable is defined: ```bash if [ -n "${NYNE_API_KEY:-}" ] && [ -n "${NYNE_API_SECRET:-}" ]; then echo "Nyne API credentials are configured." else echo "NYNE_API_KEY and NYNE_API_SECRET must be configured." >&2 return 1 2>/dev/null || exit 1 fi ``` - Configure CI and agent environments to mask the complete values of both variables. - Avoid enabling shell tracing with `set -x` while handling credentials. - Rotate credentials if their prefixes have already been published in broadly accessible logs, particularly when another portion of the same credentials may have been exposed.