T09 · Insecure Skill Coding Practices
- Location
SKILL.md:27- Finding
API Key Stored in Persistent Agent Memory or Context
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 27–34
Vulnerability Type: Insecure credential storage
Risk Level: MediumVulnerable Code
markdown **For AI Agents with Memory:** - Store credentials in your persistent memory/context - Never expose your API key in public logs or outputs - Each agent should have its own unique API key **Key Format:** `sk_live_xxxxxxxxxxxxxxxxxxxx` **Example storage pattern:**AGENTPIXELS_API_KEY=sk_live_your_key_here
text Technical Analysis
The skill explicitly recommends storing a bearer API key in persistent agent memory or context. Agent memory and model context are not dedicated secret-storage mechanisms. Their contents may be retrieved in future sessions, incorporated into prompts, captured in diagnostics or backups, exposed through prompt injection, or accidentally included in generated output.
Although the documentation warns against exposing the key, that warning does not mitigate the risk created by placing the raw credential in a broadly reusable persistence layer. The environment-variable-style example is also ambiguous because it appears directly under the persistent-memory recommendation and does not require a protected runtime secret manager.
Because the credential is a bearer token, possession is sufficient for authentication; an attacker does not need an additional password or cryptographic proof.
Attack Path
- An agent registers through
POST /agents/register. - The service returns an API key matching the documented
sk_live_...format. - Following the skill instructions, the agent saves the raw key in persistent memory or context.
- A later prompt-injection attempt, memory retrieval, diagnostic export, backup, log, or generated response reveals the stored value.
- The attacker copies the bearer token.
- The attacker supplies it in the
Authorization: Bearer ...header to authenticated AgentPixels endpoints. - Requests made with the compromised key are ...[truncated 912 chars]
- An agent registers through
- Remediation
View remediation
Remediation Suggestions
- Remove the recommendation to store raw credentials in persistent agent memory or model context.
- Store the key in a dedicated secret-management facility, such as an operating-system keychain, managed secrets vault, or protected environment variable injected only at runtime.
- Ensure the secret is excluded from prompts, memory records, source control, logs, telemetry, crash reports, and generated output.
- Retrieve the key only immediately before an authenticated request and avoid retaining it in conversational state.
- Apply restrictive access controls to the credential store and limit access to the process that requires the key.
- Add a documented revocation and rotation mechanism so a compromised key can be invalidated without creating an unrelated replacement identity.
- Redact values matching the
sk_live_...pattern from logs and outputs. - Prefer short-lived, narrowly scoped credentials if the service supports them, and monitor for anomalous use.