T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:160
- Finding
- Plaintext Collection and Client-Side Embedding of an Application Secret## Vulnerability Details **File Location**: `SKILL.md:160-189`, with the client-side initialization instruction at `SKILL.md:287` **Vulnerability Type**: Plaintext sensitive-data storage and insecure secret handling **Risk Level**: Medium ### Vulnerable Code and Instructions The workflow requires the configuration workbook to be copied into the project root: ```text Generate assets/FlyVerify_HarmonyOS_Config_Template.xlsx Copy it to the user's project root as FlyVerify_HarmonyOS_Config.xlsx ``` It then requires the application secret to be entered and read from that workbook: ```text appKey: required and must not be empty appSecret: required and must not be empty appKey and appSecret are always processed as strings. ``` The integration instructions subsequently show the secret being supplied directly to client initialization code: ```ts ZztSDK.init(context, "YourAppKey", "YourAppSecret") ``` ### Technical Analysis The prescribed workflow stores `appSecret` in a plaintext XLSX file placed in the root of the user's application project. Project-root files are commonly committed to source control, copied into project archives, synchronized through developer backup services, or shared during troubleshooting. The Skill does not require the generated workbook to be deleted after use, excluded through `.gitignore`, protected with restrictive filesystem permissions, or checked by secret-scanning controls. It also directs the Agent to insert the value into client application code. Values embedded in a distributed client application generally cannot be considered confidential because source repositories, compiled packages, runtime memory, and application resources may be inspected. ### Attack Path 1. A developer follows the Skill and generates `FlyVerify_HarmonyOS_Config.xlsx` in the application project root. 2. The developer enters the MobTech `appSecret` into the workbook. 3. The workbook is accidentally co ...[truncated 984 chars]
- Remediation
- ## Remediation Suggestions 1. Confirm with the SDK vendor whether `appSecret` is genuinely required in the client application. If it is not, move all secret-dependent operations to a trusted backend. 2. Do not request or store `appSecret` in the generated Excel workbook. 3. Use a non-secret application identifier in client code and perform sensitive authentication or token exchange on a backend service. 4. If local configuration is unavoidable, store it in a dedicated local-only file that is excluded from version control and packaging. 5. Add explicit `.gitignore` entries for `FlyVerify_HarmonyOS_Config.xlsx` and any generated credential-bearing configuration files. 6. Require deletion of the workbook immediately after validated configuration has been transferred. 7. Add repository and CI secret scanning to detect accidental credential commits. 8. Prevent secrets from appearing in generated documentation, command output, logs, screenshots, or Agent responses. 9. Rotate any credential that has already been committed, shared, or embedded in a distributed build. 10. Clearly document that any value embedded in a client application must be treated as recoverable by end users and attackers.