T09 · Insecure Skill Coding Practices
- Location
SKILL.md:31- Finding
Bearer API Key Exposed Through Agent Context and Plaintext Shell Configuration
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 31-40
Vulnerability Type:T09: Insecure Skill Coding Practices
Risk Level: Mediumbash export HKINS_API_KEY=hkins_xxxxThe surrounding instructions tell the user to provide the API key to the agent and recommend persisting it in
~/.zshrcor~/.bashrc.Technical Analysis
The skill handles a bearer API key using two insecure practices:
- It asks the user to give the key to the agent, which may expose the credential to conversation history, model context, tool-call records, telemetry, or logs.
- It recommends storing the key in a plaintext shell startup file. Such files may be readable by other local processes, included in backups, collected in diagnostic bundles, or accidentally committed to a repository. Exporting the key also propagates it to descendant processes that do not necessarily require access.
A bearer token grants access based solely on possession. An attacker who retrieves it does not need an additional password or cryptographic proof to authenticate to the declared remote service.
Attack Path
- The user registers for the service and generates a bearer API key.
- Following the skill instructions, the user provides the raw key to the agent or inserts it into a shell startup file.
- The key is retained in conversation or tool logs, shell configuration, backups, process environments, or other accessible storage.
- An attacker or unauthorized local process obtains the key from one of these locations.
- The attacker sends requests to the remote MCP endpoint using the stolen bearer token.
- The attacker consumes the account's free or paid quota until the key is revoked or regenerated.
Impact Assessment
Exploitation grants the attacker the remote API privileges associated with the compromised key. This may allow unauthorized insurance-data queries, depletion of paid or free API quota, service disruption t ...[truncated 331 chars]
- Remediation
View remediation
Remediation Suggestions
- Never ask users to paste raw bearer tokens into conversations or agent prompts.
- Direct users to configure the credential locally without exposing its value to the agent.
- Prefer an operating-system keychain, a dedicated secret manager, or the MCP client's protected secret configuration.
- If file-based storage is unavoidable, use a dedicated credential file outside the project directory and restrict it to the owning user, for example with permissions equivalent to
0600. - Avoid globally exporting the key from general-purpose shell startup files. Inject it only into the specific process that requires it.
- Ensure credentials are redacted from command output, logs, error messages, telemetry, and diagnostic reports.
- Document immediate key rotation if a token has been pasted into a conversation, committed to source control, or otherwise exposed.
- Where supported, use scoped, short-lived, and revocable credentials with spending or quota limits.