T09 · Insecure Skill Coding Practices
- Location
SKILL.md:32- Finding
Plaintext API Key May Be Committed Because Promised Gitignore Protection Is Missing
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:32-40
Related Code Location:references/kakao_local.ps1.md:102-110
Vulnerability Type: Plaintext credential exposure caused by insecure configuration guidance
Risk Level: MediumThe documentation instructs users to create a plaintext API-key file within the project:
markdown ### 방법 2: Config 파일 `skills/kakao-local/data/config.json` (create this file) 생성: ```json { "api_key": "your_rest_api_key_here" }⚠️ 주의:
config.json은.gitignore에 추가하여 커밋 금지text The script then reads and uses the credential directly from that file: ```powershell # 3순위: config.json 파일 $configPath = Join-Path $PSScriptRoot "..\data\config.json" if (Test-Path $configPath) { try { $config = Get-Content $configPath -Raw -Encoding UTF8 | ConvertFrom-Json if ($config.api_key -and $config.api_key -ne "your_rest_api_key_here") { return $config.api_key } } catch { # 파일 읽기 실패 시 무시 } }Technical Analysis
The project documentation and displayed file tree claim that
config.jsonis protected by.gitignore, but the audited package contains no.gitignore. A user following the documented fallback stores a valid Kakao REST API key as plaintext under the repository without the promised source-control exclusion.This is an insecure secret-management practice. The vulnerability does not automatically transmit the key to an attacker, but it creates a credible disclosure path through routine source-control operations. The environmental-variable method is safer and is correctly recommended, but the insecure file-based method remains supported without an effective packaging safeguard.
Attack Path
- A user follows
SKILL.mdand createsdata/config.json. - The user places a valid Kakao REST API key in the
api_keyfield. - The user relies on the documentation's statement that the file is gitignored.
- Because the package contains no `.gi ...[truncated 1026 chars]
- A user follows
- Remediation
View remediation
Remediation Suggestions
-
Add an actual project-root
.gitignorecontaining a narrowly scoped rule:gitignore /data/config.json -
Ensure the published package includes that file rather than merely documenting it.
-
Prefer process-scoped environment variables or an operating-system credential manager. Consider removing the plaintext configuration fallback entirely.
-
If file-based configuration must remain supported:
- Store it outside the repository by default.
- Restrict its filesystem ACLs to the current user.
- Reject placeholder values and validate file permissions.
- Emit a warning when the file is located inside a source-controlled working tree.
- Check whether it is tracked, for example with
git ls-files --error-unmatch, when Git is available.
-
Add automated packaging and CI checks that fail if:
data/config.jsonis tracked.- A value matching the API-key configuration pattern appears in committed files.
- The required
.gitignorerule is absent.
-
If a key has already been committed, revoke and rotate it immediately, remove it from repository history, and audit its usage for unauthorized requests.
-