T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:182
- Finding
- Agent-Level Credential Access and Unsafe Query-String Authentication<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 182-193 **Vulnerability Type**: Credential exposure through unnecessary environment access and unsafe authentication transport **Risk Level**: Medium ### Vulnerable Code Snippet ```text Skill-side authentication: The AI reads the key from the PANGOLINFO_API_KEY environment variable. This is the Skill's default key source. The AI should read it directly instead of repeatedly asking the user. MCP server-side authentication: The key may be supplied through: --api-key=<key> PANGOLINFO_API_KEY ~/.pangolinfo/config.json hosted URL ?api_key=<key> Authorization: Bearer <key> Configuration examples: export PANGOLINFO_API_KEY="eyJhbGci..." MCP URL ?api_key=eyJhbGci... Authorization: Bearer eyJhbGci... ``` The same unsafe authentication guidance is repeated at `SKILL.md`, line 404. ### Technical Analysis The Skill explicitly directs the AI agent to read the `PANGOLINFO_API_KEY` environment variable. This unnecessarily brings a reusable JWT credential into the agent's accessible context. The declared MCP-native architecture does not require the agent to possess the raw credential: line 24 states that the client injects the key into the MCP connection. This creates an avoidable least-privilege violation. The agent only needs authorization to invoke configured MCP tools; it does not need permission to retrieve, inspect, reproduce, or otherwise handle the underlying bearer credential. The Skill also endorses transmitting the JWT in an MCP URL query parameter: ```text ?api_key=<key> ``` Query-string credentials can be recorded by URL histories, application and reverse-proxy logs, telemetry systems, exception reports, monitoring platforms, and diagnostic output. Unlike a purpose-built authorization header, query parameters are routinely retained as part of the complete URL. No hardcoded credential was found in the repository. The risk arises from instructions that cause runtime s ...[truncated 1940 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Remove agent-level secret access** - Delete instructions telling the AI to read `PANGOLINFO_API_KEY`. - Ensure the raw credential never enters prompts, model context, ordinary tool arguments, or generated responses. - Grant the agent permission to invoke only the required MCP tools, not permission to retrieve the credential backing the connection. 2. **Use client-managed authentication exclusively** - Configure the MCP client or a dedicated secret manager to inject authentication outside the agent context. - Adopt a single authentication model consistent with the statement at line 24 that the client injects the key. - Do not ask the agent to inspect configuration files such as `~/.pangolinfo/config.json`. 3. **Prohibit query-string credentials** - Remove every `?api_key=<key>` example and recommendation, including the repeated guidance at line 404. - Use an `Authorization: Bearer <key>` header supplied by protected MCP client configuration. - Ensure the header is never represented in ordinary tool arguments or conversational output. 4. **Add explicit redaction requirements** - Redact `Authorization`, `PANGOLINFO_API_KEY`, JWT-shaped values, and legacy `api_key` parameters from logs, traces, telemetry, errors, and diagnostics. - Prevent connection configuration from being displayed to the model or end user. - Add automated tests confirming that secrets cannot appear in generated responses or debug logs. 5. **Harden credential lifecycle management** - Use short-lived, narrowly scoped tokens where supported. - Rotate any token previously placed in a query string or exposed to agent context. - Provide immediate revocation and usage-monitoring mechanisms. - Alert on abnormal quota consumption or unexpected client locations. 6. **Resolve contradictory documentation** - Reconcile line 24, which says no API-key environment variable is needed, with lines 182-193 and 404, which ...[truncated 119 chars]