T09 · Insecure Skill Coding Practices
Error
- Location
- billing-final.js:7
- Finding
- Hard-Coded Billing API Credential Exposes the Skill's Billing Identity<![CDATA[ ## Vulnerability Details **File Location**: `billing-final.js:7-15`; duplicated in `billing.js:8-16` and `SKILL.md:7-11` **Vulnerability Type**: Hard-coded secret and reusable API credential **Risk Level**: High ### Vulnerable Code ```javascript const axios = require('axios'); // Billing API URL / 課金API URL / Ссылка на API биллинга const BILLING_API_URL = 'https://skillpay.me/api/v1/billing'; const API_KEY = 'sk_f072a786149bc07fc8730b4683dc00f3e050e72441922284ca803cdee2b994b5'; const SKILL_ID = '282279e4-5370-4b9e-b5e7-9e07f0b3dc5c'; // Headers / ヘッダー / Заголовки const headers = { 'X-API-Key': API_KEY, 'Content-Type': 'application/json' }; ``` The credential is subsequently transmitted in requests such as: ```javascript const resp = await fetch(`${BILLING_API_URL}/charge`, { method: 'POST', headers: { 'X-API-Key': API_KEY, 'Content-Type': 'application/json' }, body: JSON.stringify({ user_id: userId, skill_id: SKILL_ID, amount }) }); ``` The same credential is also published in the Skill metadata: ```yaml payment: provider: skillpay.me api_key: sk_f072a786149bc07fc8730b4683dc00f3e050e72441922284ca803cdee2b994b5 price: 0.005 currency: USDT billing_mode: per_call ``` ### Technical Analysis A reusable API credential is embedded in source code and plaintext package metadata. Anyone with access to the package can extract the credential without executing the Skill. The source then uses that credential as an `X-API-Key` when invoking balance, charge, and payment-link endpoints. Sending an authentication credential to the declared billing provider is necessary for the billing feature, but distributing a shared secret to every Skill recipient is not a least-privilege design. Client-side embedded credentials cannot remain confidential. The exact server-side permissions of the key cannot be established from the supplied files. However, the available client code demonstrates that the key is accepted by endpoin ...[truncated 1334 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed API key. 2. Remove the key from all source files, documentation, metadata, repository history, published archives, and examples. 3. Do not replace it with another static credential in client-distributed code. 4. Route privileged billing operations through a trusted backend that keeps the provider credential server-side. 5. Give clients short-lived, user-bound, narrowly scoped authorization tokens where direct client requests are unavoidable. 6. Restrict tokens by skill ID, user ID, permitted endpoint, maximum charge amount, expiration time, and replay-resistant request identifiers. 7. Enforce all authorization and amount validation on the billing server; never trust a client-supplied `user_id`, `skill_id`, or `amount` without verification. 8. Add rate limiting, anomaly detection, idempotency keys, and immutable billing audit logs. 9. Use a secret-scanning gate in CI and pre-commit tooling to prevent future credential publication. 10. Review billing logs for misuse of the disclosed key and notify affected parties if unauthorized activity is identified. ]]>