T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:82
- Finding
- WordPress API Credential Requested Through Plaintext Prompt Input## Vulnerability Details **File Location**: `SKILL.md:82-89` **Vulnerability Type**: Plaintext sensitive credential exposure **Risk Level**: Medium ### Vulnerable Code ```text Scan my WordPress blog for all product mentions across 10 recent posts. Generate a report showing: 1. Which products can be monetized (with affiliate network options) 2. Where to insert FTC disclosures 3. Recommended link anchor text for SEO 4. Compliance risk assessment WordPress URL: https://myblog.com API key: [your WordPress REST API key] ``` ### Technical Analysis The usage example directs users to submit a WordPress REST API credential directly in an agent prompt. Prompt content may be retained in conversation history, telemetry, debugging traces, application logs, or downstream model context. The skill does not prescribe a protected secret-reference mechanism, credential redaction, minimum scopes, or short-lived credentials. This creates unnecessary credential exposure. Although the file contains only documentation and no executable implementation, users following the documented workflow could disclose a privileged secret to every component that processes or records the prompt. ### Attack Path 1. A user follows the example and enters a valid WordPress REST API credential in the prompt. 2. The prompt is processed or retained by the agent platform, logging infrastructure, integrations, or conversation storage. 3. An unauthorized user or compromised component obtains access to that retained content. 4. The exposed credential is submitted to the target WordPress REST API. 5. The attacker performs operations allowed by the credential until it expires or is revoked. This path requires exposure of prompt history or associated logs; the audited skill itself does not contain code that actively exfiltrates the credential. ### Impact Assessment Impact depends on the WordPress identity and permissions associated with the credential ...[truncated 489 chars]
- Remediation
- ## Remediation Suggestions - Remove instructions asking users to paste API credentials into prompts. - Load the credential from a protected environment variable or secret manager, such as `WORDPRESS_API_TOKEN`, and pass only a secret reference to the integration. - Use a dedicated WordPress application password or access token rather than the user's primary password. - Grant only the minimum permissions required for the requested operation. Report generation should use read-only access; content updates should require a separate, explicitly approved write capability. - Prefer short-lived and revocable credentials where the platform supports them. - Redact authorization headers, tokens, application passwords, and related values from logs, traces, error messages, and generated reports. - Add explicit documentation warning users not to include credentials in chat messages, pasted content, command-line arguments, or committed configuration files. - Separate suggestion mode from publication mode and require explicit confirmation before using write-capable WordPress credentials. - Rotate any credential previously submitted through prompts or retained in conversation history.