T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:345- Finding
Unsafe API Credential Access and Query-String Transmission Guidance
- Content
View full analysis
- Environment: PANGOLINFO_API_KEY - Configuration: ~/.pangolinfo/config.json - Hosted URL: ?api_key= - HTTP header: Authorization: Bearer First-time configuration: export PANGOLINFO_API_KEY="eyJhbGci..." Alternatively, place the key in ~/.pangolinfo/config.json, append ?api_key=eyJhbGci... to the MCP URL, or use Authorization: Bearer eyJhbGci... ``` The same unsafe alternatives are reiterated at line 567: ```text MCP-side authentication may use CLI/configuration, URL ?api_key=, or Authorization: Bearer . ``` ### Technical Analysis The Skill instructs the AI agent itself to read a JWT API credential from `PANGOLINFO_API_KEY`. Authentication should ordinarily be performed inside the MCP server or another trusted credential boundary. Allowing the agent to access the raw secret unnecessarily expands the credential's exposure surface to the model context, tool-call records, debugging output, traces, and any other components capable of observing agent operations. The Skill also recommends placing the credential in a URL query parameter: ```text ?api_key= ``` Query-string credentials are unsafe because complete URLs are commonly retained by reverse proxies, application servers, access logs, browser history, monitoring systems, analytics systems, screenshots, copied configuration, and diagnostic reports. Depending on client and redirect behavior, ...[truncated 1916 chars]- Remediation
View remediation
`. 4. Prefer an `Authorization: Bearer ` header transmitted exclusively over TLS. 5. Store credentials using an operating-system secret store, managed secret service, or permission-restricted MCP configuration. 6. Ensure configuration and log files containing authentication metadata are excluded from source control and readable only by the owning user or service account. 7. Redact `Authorization`, `api_key`, JWT-shaped values, and related secrets from logs, traces, telemetry, exception messages, and support bundles. 8. Use short-lived, narrowly scoped credentials where the service supports them. 9. Document an incident procedure requiring immediate revocation and rotation after a key appears in a URL, model transcript, log, or diagnostic artifact. 10. Add automated secret scanning and tests that reject query-string credentials and prevent raw environment-secret values from entering agent prompts or tool arguments. ]]>