T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:193
- Finding
- Hardcoded LTX API Bearer Token in Distributed Documentation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:193-197` **Vulnerability Type**: Hardcoded credential and disclosure of a credential-storage path **Risk Level**: Critical ### Vulnerable Code ```text ## API Key Paul's key: stored in `~/clawd/.env` as `LTX_API_KEY` ``` The following fenced block contains a complete `ltxv_...` bearer token. The token is intentionally redacted from this report to prevent further credential exposure. ### Technical Analysis The Skill embeds a complete API bearer token in a file intended for distribution and also discloses the local path from which the credential may be obtained. Bearer tokens generally grant access to anyone possessing the token, without an additional proof-of-possession mechanism. Although authentication to the LTX API is necessary for the declared video-generation functionality, distributing a specific user's credential is not necessary. The minimum-privilege design is for each user to supply a separately scoped API key through an environment variable or secret manager. Because the credential has already been committed to the artifact, deleting it from the current file alone is insufficient. Copies may remain in version-control history, package archives, logs, caches, and downloaded Skill bundles. ### Attack Path 1. An attacker downloads or otherwise obtains the Skill package. 2. The attacker opens `SKILL.md` and extracts the embedded bearer token. 3. The attacker sends requests to `https://api.ltx.video/v1/...` with `Authorization: Bearer <stolen-token>`. 4. Requests are charged against or attributed to the credential owner until the token is revoked or expires. 5. If the attacker also has local access, the disclosed `~/clawd/.env` path identifies an additional source from which current or replacement credentials may be collected. ### Impact Assessment Successful exploitation may permit unauthorized use of the LTX account within the token's se ...[truncated 440 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed token immediately; do not assume that removing it from the latest file makes it safe. 2. Remove the token from the current artifact, version-control history, release archives, caches, examples, and logs. 3. Replace the content with a neutral placeholder such as: ```text Set your own LTX_API_KEY environment variable. Never commit the key. ``` 4. Require every user to provide an independently issued, least-privileged API key. 5. Store credentials in a secret manager or protected environment variable, not documentation or source files. 6. Avoid identifying a specific person's credential or disclosing unnecessary local secret paths. 7. Add automated secret scanning and pre-commit checks to block bearer tokens from future releases. 8. Review LTX usage and billing logs for abuse occurring after the credential was exposed. ]]>