T09 · Insecure Skill Coding Practices
- Location
SKILL.md:143- Finding
Private Ed25519 Signing Key Exposed Through Standard Output
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 143–159
Vulnerability Type: Plaintext secret disclosure through standard output
Risk Level: HighComplete Code Snippet
python # Serialize the private key (store this securely --- never share it) private_key_bytes = private_key.private_bytes( encoding=serialization.Encoding.Raw, format=serialization.PrivateFormat.Raw, encryption_algorithm=serialization.NoEncryption() ) # Serialize the public key (this goes in your agent registration) public_key_bytes = public_key.public_bytes( encoding=serialization.Encoding.Raw, format=serialization.PublicFormat.Raw ) private_key_b64 = base64.b64encode(private_key_bytes).decode() public_key_b64 = base64.b64encode(public_key_bytes).decode() print(f"Private key (keep secret): {private_key_b64}")Technical Analysis
The example serializes the raw Ed25519 private key without encryption, applies Base64 encoding, and prints the result. Base64 is a reversible transport encoding and provides no confidentiality.
Although the accompanying comment says never to share the key, printing it directly contradicts that guidance. In an AI-agent environment, standard output may be returned to the caller and retained in conversation history, execution traces, application logs, observability platforms, or other telemetry. Anyone able to read one of those channels can decode and import the private key.
The code does not constitute covert exfiltration to an undeclared third party, but it unnecessarily expands exposure of a credential that should remain confined to secure storage. This exceeds the minimum privileges and data handling required to generate and register an agent identity.
Attack Path
- A user or agent runs the documented key-generation example.
- The raw private key is serialized without encryption and Base64-encoded.
- The complete encoded private key is emitted ...[truncated 1138 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all output of private-key material. Print only the public key or a non-sensitive fingerprint.
- Store the generated private key directly in a dedicated secrets manager, hardware-backed keystore, or protected file rather than passing it through standard output.
- If file storage is necessary, create the file with owner-only permissions such as
0600, avoid shared temporary directories, and prevent backup or telemetry systems from collecting it. - Prefer encrypted private-key serialization using a strong passphrase when the selected key format supports it. Do not describe Base64 as a security control.
- Configure application logging, exception handling, tracing, and agent responses to redact private keys and related environment variables.
- Use separate environment variable names consistently. The metadata declares
AGENT_SIGNING_KEY, while examples later referenceGREENHELIX_PRIVATE_KEY; standardizing the name reduces unsafe manual key handling. - Add an explicit rotation procedure. Any key previously printed or logged should be revoked or deregistered and replaced immediately.
- Provide a safer example that writes the secret directly to protected storage and returns only the public key:
python import os private_key_path = "agent-signing-key.bin" fd = os.open( private_key_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600, ) with os.fdopen(fd, "wb") as key_file: key_file.write(private_key_bytes) print(f"Public key: {public_key_b64}") print(f"Private key stored securely at: {private_key_path}")