T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:32
- Finding
- Plaintext API Key May Be Committed Because Promised Gitignore Protection Is Missing## Vulnerability Details **File Location**: `SKILL.md:32-40` **Related Code Location**: `references/kakao_local.ps1.md:102-110` **Vulnerability Type**: Plaintext credential exposure caused by insecure configuration guidance **Risk Level**: Medium The documentation instructs users to create a plaintext API-key file within the project: ```markdown ### 방법 2: Config 파일 `skills/kakao-local/data/config.json` (create this file) 생성: ```json { "api_key": "your_rest_api_key_here" } ``` **⚠️ 주의**: `config.json`은 `.gitignore`에 추가하여 커밋 금지 ``` The script then reads and uses the credential directly from that file: ```powershell # 3순위: config.json 파일 $configPath = Join-Path $PSScriptRoot "..\data\config.json" if (Test-Path $configPath) { try { $config = Get-Content $configPath -Raw -Encoding UTF8 | ConvertFrom-Json if ($config.api_key -and $config.api_key -ne "your_rest_api_key_here") { return $config.api_key } } catch { # 파일 읽기 실패 시 무시 } } ``` ### Technical Analysis The project documentation and displayed file tree claim that `config.json` is protected by `.gitignore`, but the audited package contains no `.gitignore`. A user following the documented fallback stores a valid Kakao REST API key as plaintext under the repository without the promised source-control exclusion. This is an insecure secret-management practice. The vulnerability does not automatically transmit the key to an attacker, but it creates a credible disclosure path through routine source-control operations. The environmental-variable method is safer and is correctly recommended, but the insecure file-based method remains supported without an effective packaging safeguard. ### Attack Path 1. A user follows `SKILL.md` and creates `data/config.json`. 2. The user places a valid Kakao REST API key in the `api_key` field. 3. The user relies on the documentation's statement that the file is gitignored. 4. Because the package contains no `.gi ...[truncated 1026 chars]
- Remediation
- ## Remediation Suggestions 1. Add an actual project-root `.gitignore` containing a narrowly scoped rule: ```gitignore /data/config.json ``` 2. Ensure the published package includes that file rather than merely documenting it. 3. Prefer process-scoped environment variables or an operating-system credential manager. Consider removing the plaintext configuration fallback entirely. 4. If file-based configuration must remain supported: - Store it outside the repository by default. - Restrict its filesystem ACLs to the current user. - Reject placeholder values and validate file permissions. - Emit a warning when the file is located inside a source-controlled working tree. - Check whether it is tracked, for example with `git ls-files --error-unmatch`, when Git is available. 5. Add automated packaging and CI checks that fail if: - `data/config.json` is tracked. - A value matching the API-key configuration pattern appears in committed files. - The required `.gitignore` rule is absent. 6. If a key has already been committed, revoke and rotate it immediately, remove it from repository history, and audit its usage for unauthorized requests.