T09 · Insecure Skill Coding Practices
- Location
SKILL.md:82- Finding
WordPress API Credential Requested Through Plaintext Prompt Input
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:82-89
Vulnerability Type: Plaintext sensitive credential exposure
Risk Level: MediumVulnerable Code
text Scan my WordPress blog for all product mentions across 10 recent posts. Generate a report showing: 1. Which products can be monetized (with affiliate network options) 2. Where to insert FTC disclosures 3. Recommended link anchor text for SEO 4. Compliance risk assessment WordPress URL: https://myblog.com API key: [your WordPress REST API key]Technical Analysis
The usage example directs users to submit a WordPress REST API credential directly in an agent prompt. Prompt content may be retained in conversation history, telemetry, debugging traces, application logs, or downstream model context. The skill does not prescribe a protected secret-reference mechanism, credential redaction, minimum scopes, or short-lived credentials.
This creates unnecessary credential exposure. Although the file contains only documentation and no executable implementation, users following the documented workflow could disclose a privileged secret to every component that processes or records the prompt.
Attack Path
- A user follows the example and enters a valid WordPress REST API credential in the prompt.
- The prompt is processed or retained by the agent platform, logging infrastructure, integrations, or conversation storage.
- An unauthorized user or compromised component obtains access to that retained content.
- The exposed credential is submitted to the target WordPress REST API.
- The attacker performs operations allowed by the credential until it expires or is revoked.
This path requires exposure of prompt history or associated logs; the audited skill itself does not contain code that actively exfiltrates the credential.
Impact Assessment
Impact depends on the WordPress identity and permissions associated with the credential ...[truncated 489 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove instructions asking users to paste API credentials into prompts.
- Load the credential from a protected environment variable or secret manager, such as
WORDPRESS_API_TOKEN, and pass only a secret reference to the integration. - Use a dedicated WordPress application password or access token rather than the user's primary password.
- Grant only the minimum permissions required for the requested operation. Report generation should use read-only access; content updates should require a separate, explicitly approved write capability.
- Prefer short-lived and revocable credentials where the platform supports them.
- Redact authorization headers, tokens, application passwords, and related values from logs, traces, error messages, and generated reports.
- Add explicit documentation warning users not to include credentials in chat messages, pasted content, command-line arguments, or committed configuration files.
- Separate suggestion mode from publication mode and require explicit confirmation before using write-capable WordPress credentials.
- Rotate any credential previously submitted through prompts or retained in conversation history.