T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cmc-sentiment.js:8- Finding
Overbroad loading of a project-external secrets file
- Content
View full analysis
{ const headers = { 'X-CMC_PRO_API_KEY': CMC_API_KEY, 'Accept': 'application/json', 'User-Agent': 'defi-scout/1.0' }; ``` ### Technical Analysis The script explicitly traverses three directories above the Skill directory and asks `dotenv` to parse a shared `.env` file. Loading that file imports all variables contained in it into the script's process environment, even though the declared functionality requires only `CMC_API_KEY`. This exceeds the minimum filesystem and secret-access scope necessary for retrieving CoinMarketCap sentiment data. The API key could instead be obtained directly from the environment using `process.env.CMC_API_KEY`, without granting the Skill access to a shared secrets file. The current implementation uses the selected key only in the `X-CMC_PRO_API_KEY` header sent over HTTPS to the fixed, declared `pro-api.coinmarketcap.com` host. The reviewed code does not transmit unrelated environment variables, so this is not evidence of intentional secret exfiltration. The risk is the unnecessarily broad availability of secrets to this script and to any compromised dependency or future modification running in the same process. ### Attack Path 1. A user stores `CMC_API_KEY` and potentially unrelated credentials in the shared ...[truncated 1095 chars]- Remediation
View remediation