T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:121
- Finding
- Private Ed25519 Signing Key Exposed Through Standard Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 121–137 **Vulnerability Type**: Plaintext secret exposure through Agent-visible output **Risk Level**: High ### Vulnerable Code ```python # Serialize private key (store securely -- this is your bot's identity) private_bytes = private_key.private_bytes( encoding=serialization.Encoding.Raw, format=serialization.PrivateFormat.Raw, encryption_algorithm=serialization.NoEncryption() ) # Serialize public key (this gets registered on GreenHelix) public_bytes = public_key.public_bytes( encoding=serialization.Encoding.Raw, format=serialization.PublicFormat.Raw ) private_key_b64 = base64.b64encode(private_bytes).decode() public_key_b64 = base64.b64encode(public_bytes).decode() print(f"Private key (keep secret): {private_key_b64}") ``` ### Technical Analysis The example serializes the Ed25519 private key in raw, unencrypted form, converts it to Base64, and prints it to standard output. Base64 is an encoding mechanism and provides no confidentiality: anyone with the output can recover the original 32-byte key. This is especially unsafe in an AI Agent context because standard output may be returned to the caller or retained in conversation history, execution logs, telemetry, CI output, terminal scrollback, or monitoring systems. The implementation therefore contradicts its own instruction to keep the key secret. The flagged Base64 operation is not itself covert code execution. The security issue arises because sensitive private-key material is encoded and then disclosed through an observable output channel. ### Attack Path 1. A user follows the documented key-generation example. 2. The example generates a new Ed25519 private key and serializes it without encryption. 3. The raw key is Base64-encoded and printed to standard output. 4. The output is captured by Agent conversation history, logs, telemetry, terminal recording, CI output, or another caller with access to the exec ...[truncated 901 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove all output of private-key material. Only the public key or a non-sensitive fingerprint should be displayed. - Generate and store the private key directly in a secret manager, hardware-backed keystore, or encrypted key file rather than converting it into a printable string. - If file storage is necessary, encrypt the private key at rest and restrict permissions to the owning account, such as mode `0600` on supported systems. - Avoid placing private keys in command-line arguments, source files, chat messages, notebooks, telemetry, or environment dumps. - Add explicit warnings that Base64 does not protect secrets. - Provide a safe example that writes the key to a protected destination without printing its value. - Document key rotation and revocation procedures. Any key previously exposed through this example should be treated as compromised and replaced. - Configure log-redaction controls as defense in depth, but do not rely on redaction as a substitute for removing the unsafe print operation. ]]>