T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:94
- Finding
- Bearer API Key Requested Through Conversation Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 94-99 **Vulnerability Type**: Exposure of authentication credentials through an insecure collection and storage workflow **Risk Level**: Medium ### Vulnerable Snippet ```markdown > Open this link to approve the agent: **{approval_url}** > After approving, copy the API key shown and paste it here. #### 3. Save the key Store the API key (starts with `citedy_agent_`). Use it as `Authorization: Bearer <key>` on all requests. ``` ### Technical Analysis The setup instructions explicitly tell the user to paste a bearer API key into the agent conversation. Conversation content can be retained in model context, application logs, debugging traces, transcript exports, or other storage that may not provide protections appropriate for authentication secrets. The subsequent instruction to “store the API key” does not specify a protected environment variable, operating-system credential store, or secret manager. It also provides no requirements for redaction, access control, retention, rotation, or deletion. Because the key is used directly as a bearer token, possession is sufficient for authentication. No additional proof of identity is described. ### Attack Path 1. A user runs the registration workflow and approves the agent through the returned approval URL. 2. Citedy displays a bearer API key beginning with `citedy_agent_`. 3. Following the Skill instructions, the user pastes that key into the conversation. 4. The key is retained in a transcript, application log, model context, debugging trace, or insecure state storage. 5. An attacker or unauthorized operator obtains access to that retained content. 6. The attacker submits the key in the `Authorization: Bearer` header to the documented Citedy agent API. 7. Within the permissions of the key, the attacker can inspect account information, consume credits, generate content, and publish lead magnets. ### Impact Assessment Successful exploitatio ...[truncated 604 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never instruct users to paste API keys into a conversation. - Require the user to configure `CITEDY_API_KEY` directly through a protected environment-variable interface or secret manager. - Ensure the agent reads the credential only at request time and does not echo, summarize, log, or persist it. - Redact values beginning with `citedy_agent_` from logs, traces, exception reports, and tool output. - Document credential rotation and revocation procedures. - Apply restrictive access controls and retention policies to any system that handles the secret. - If interactive credential transfer is unavoidable, use a dedicated secret-input control whose contents are excluded from conversation history and model context. ]]>