T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:60
- Finding
- API Credential Exposed in MCP URL Query Parameter## Vulnerability Details **File Location**: `SKILL.md`, lines 60–69 **Vulnerability Type**: API credential exposure through a URL query parameter **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "sanctifai": { "url": "https://app.sanctifai.com/mcp?access_token=sk_live_xxx" } } } ``` ```text The `access_token` query parameter carries your API key — the same `sk_live_xxx` you get from registration. ``` ### Technical Analysis The Skill explicitly instructs users to place a live API key in the MCP endpoint's query string. Although HTTPS protects the URL in transit, query strings are more likely than authorization headers to be retained in MCP client configuration, reverse-proxy and access logs, telemetry, monitoring platforms, diagnostic output, crash reports, configuration backups, or support bundles. The example uses a placeholder rather than a real embedded credential. The vulnerability is therefore the documented credential-handling pattern: users following the instructions would substitute an operational secret into a location that may be persistently recorded or disclosed to components that do not require access to it. Because the query parameter acts as a bearer credential, possession may be sufficient for authentication. No additional proof of identity is described. ### Attack Path 1. A user follows the Skill and replaces `sk_live_xxx` with a valid SanctifAI API key. 2. The MCP client saves the complete endpoint URL in its configuration. 3. The URL is captured by a log, diagnostic report, telemetry system, configuration backup, proxy, or another process with access to the client configuration. 4. An attacker or unauthorized operator retrieves the token-bearing URL. 5. The attacker extracts the `access_token` value and reuses it against authenticated SanctifAI interfaces. 6. The attacker performs operations permitted to the compromised agent until the key is rotated, revoked, or otherwise expires. ### Impact As ...[truncated 852 chars]
- Remediation
- ## Remediation Suggestions 1. Replace query-parameter authentication with an `Authorization: Bearer` header supported by the MCP client or transport. 2. If the client supports secret references, obtain the token from a protected environment variable, operating-system credential store, or secrets manager rather than writing it directly into configuration. 3. Do not include credentials in URLs, command-line arguments, examples copied into tickets, or diagnostic output. 4. Configure MCP clients, proxies, monitoring systems, and application logs to redact authorization data and query parameters. 5. Apply restrictive permissions to configuration files and backups containing connection details. 6. Rotate any API key that has previously been stored in a URL or exposed through logs, telemetry, support bundles, or version control. 7. Use scoped, short-lived, and revocable credentials where the platform supports them. 8. Enforce least privilege and configure per-task and daily spending limits to reduce financial impact after credential compromise. 9. Add explicit documentation warning that bearer credentials must not be placed in URLs and provide a secure configuration example.