T09 · Insecure Skill Coding Practices
- Location
SKILL.md:20- Finding
Plaintext API-Key Persistence and Exposure Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:20-26; related command examples atreferences/api.md:607-625
Vulnerability Type: Plaintext credential storage and insecure secret handling
Risk Level: MediumVulnerable Snippets
Faithful English translation of
SKILL.md:20-26:markdown 1. **Check existing key**: Read `references/api_key.txt`; use it directly if it exists. 2. **Obtain a new key** when no key exists or the key is invalid. 3. **Save key**: Write the obtained key to `references/api_key.txt`.Request pattern from
references/api.md:607-625:bash curl -s -X POST "https://asia-test-private.nint.hk/api/skill/get-global-primary-categories" \ -H "Content-Type: application/json" \ -d '{"api_key":"xxx","start_month":"2026-01","end_month":"2026-01","platform_ids":[47]}'The same section supplies additional commands that embed
api_keydirectly inside the curl command argument.Technical Analysis
The Skill instructs the Agent to persist an authentication credential in
references/api_key.txt, a plaintext file inside the project directory. It specifies no restrictive file permissions, operating-system credential store, encryption, version-control exclusion, lifecycle policy, or secure deletion procedure.Storing the key under the project tree creates several exposure channels:
- The credential may be included in a repository commit, archive, backup, or Skill package.
- Other local users or processes may read it when default filesystem permissions are permissive.
- Workspace-indexing, diagnostic, or file-inspection tools may ingest and disclose it.
- The key may remain after the Agent session ends, increasing the exposure period.
The documented curl pattern introduces a second exposure channel because the JSON containing the key is supplied as a command-line argument. Depending on the operating system and execution environment, command arguments can become v ...[truncated 2140 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction to write credentials into
references/api_key.txt. - Store the key in an operating-system credential manager or a secrets-management service. A protected environment variable may be used when a credential manager is unavailable.
- If file-based storage is unavoidable:
- Store the file outside the project and repository trees.
- Create it with owner-only permissions, such as mode
0600. - Add the path to version-control and packaging exclusion rules.
- Avoid backups and workspace indexing.
- Delete the file securely when the credential is revoked or no longer required.
- Avoid placing the key directly in command-line arguments. Construct the request through a client that reads the secret from a protected process environment, or send the body through standard input without echoing or logging it.
- Redact
api_keyvalues from Agent messages, tool output, errors, telemetry, debug traces, and audit logs. - Correct
SKILL.md:12so that it consistently requires JSON-body authentication and explicitly prohibits query-string authentication. - Define credential rotation and revocation procedures for suspected disclosure.
- Apply minimum API permissions and conservative quotas to temporary keys to reduce the impact of compromise.
- Remove the instruction to write credentials into