T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:35
- Finding
- API Key Exposure Through Terminal Output and Conversation History<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 35–46 **Vulnerability Type**: Plaintext secret exposure **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Check the `MIRA_KEY` environment variable: `echo $MIRA_KEY` If no key is found, ask the user: > "Do you have a Mira API key?" - **Yes** — ask them to provide it, then set it as an environment variable: ```bash export MIRA_KEY="mira_your_key_here" ``` ``` ### Technical Analysis The setup procedure instructs the agent to execute `echo $MIRA_KEY`. This prints the complete API key to command output rather than merely testing whether the variable exists. The exposed value may subsequently be retained in tool-call records, terminal transcripts, diagnostic logs, or other session artifacts. The instructions also direct the agent to ask the user to provide the key and then place it directly in an `export` command. Supplying a credential through an ordinary conversation can store it in chat history, while embedding it in a shell command may expose it through shell history or command logging. The API documentation confirms that this key is subsequently used as a bearer credential in the `Authorization` header. Anyone who obtains the plaintext value can authenticate with the same API authority until the key expires, is disabled, or is rotated. ### Attack Path 1. A user or operator invokes the skill for the first time. 2. The agent follows the setup instructions and executes `echo $MIRA_KEY`. 3. If the variable is populated, its complete value is written to captured command output. 4. If it is not populated, the agent asks the user to provide the key through the conversation and may execute an `export` command containing the plaintext credential. 5. An attacker with access to conversation records, tool output, terminal logs, or shell history retrieves the credential. 6. The attacker sends requests to the OpenJobs AI API using `Authorization: Bearer <stolen-key>`. 7. Requests consu ...[truncated 511 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never print the value of `MIRA_KEY`. Test only whether it is present: ```bash if [ -n "${MIRA_KEY:-}" ]; then echo "MIRA_KEY is configured" else echo "MIRA_KEY is not configured" fi ``` - Do not ask users to paste API keys into an ordinary conversation. - Provision the credential through the platform's protected secret-management or environment-configuration mechanism. - Avoid placing literal credentials in shell commands that may be retained in history. If interactive configuration is unavoidable, use hidden input and disable history for the operation. - Redact `Authorization` headers and environment-variable values from tool output, application logs, error reports, and diagnostic traces. - Use narrowly scoped, revocable API keys and document a rotation procedure for potentially exposed credentials. ]]>