T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:182- Finding
Agent-Level Credential Access and Unsafe Query-String Authentication
- Content
View full analysis
PANGOLINFO_API_KEY ~/.pangolinfo/config.json hosted URL ?api_key= Authorization: Bearer Configuration examples: export PANGOLINFO_API_KEY="eyJhbGci..." MCP URL ?api_key=eyJhbGci... Authorization: Bearer eyJhbGci... ``` The same unsafe authentication guidance is repeated at `SKILL.md`, line 404. ### Technical Analysis The Skill explicitly directs the AI agent to read the `PANGOLINFO_API_KEY` environment variable. This unnecessarily brings a reusable JWT credential into the agent's accessible context. The declared MCP-native architecture does not require the agent to possess the raw credential: line 24 states that the client injects the key into the MCP connection. This creates an avoidable least-privilege violation. The agent only needs authorization to invoke configured MCP tools; it does not need permission to retrieve, inspect, reproduce, or otherwise handle the underlying bearer credential. The Skill also endorses transmitting the JWT in an MCP URL query parameter: ```text ?api_key= ``` Query-string credentials can be recorded by URL histories, application and reverse-proxy logs, telemetry systems, exception reports, monitoring platforms, and diagnostic output. Unlike a purpose-built authorization header, query parameters are routinely retained as part of the complete URL. No hardcoded credential was found in the repository. The risk arises from instructions that cause runtime s ...[truncated 1940 chars]- Remediation
View remediation
` example and recommendation, including the repeated guidance at line 404. - Use an `Authorization: Bearer ` header supplied by protected MCP client configuration. - Ensure the header is never represented in ordinary tool arguments or conversational output. 4. **Add explicit redaction requirements** - Redact `Authorization`, `PANGOLINFO_API_KEY`, JWT-shaped values, and legacy `api_key` parameters from logs, traces, telemetry, errors, and diagnostics. - Prevent connection configuration from being displayed to the model or end user. - Add automated tests confirming that secrets cannot appear in generated responses or debug logs. 5. **Harden credential lifecycle management** - Use short-lived, narrowly scoped tokens where supported. - Rotate any token previously placed in a query string or exposed to agent context. - Provide immediate revocation and usage-monitoring mechanisms. - Alert on abnormal quota consumption or unexpected client locations. 6. **Resolve contradictory documentation** - Reconcile line 24, which says no API-key environment variable is needed, with lines 182-193 and 404, which ...[truncated 119 chars]