T09 · Insecure Skill Coding Practices
- Location
SKILL.md:18- Finding
Hard-Coded Administrative Bearer Token
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:18-19,SKILL.md:39-40,SKILL.md:158-161, andSKILL.md:179
Vulnerability Type: Hard-coded reusable administrative credential
Risk Level: MediumVulnerable Code
SKILL.md:18-19:markdown - **Token**: `morfeo-admin-2026` (o `$MORFEO_API_TOKEN`) - **Auth header**: `Authorization: Bearer morfeo-admin-2026`SKILL.md:39-40:bash TOKEN="morfeo-admin-2026" H_AUTH="Authorization: Bearer $TOKEN"SKILL.md:158-161:python HEADERS = { "Authorization": "Bearer morfeo-admin-2026", "x-project-id": "morfeo_labs" }SKILL.md:179:bash curl -s http://localhost:3336/api/runs -H "Authorization: Bearer morfeo-admin-2026" -H "x-project-id: morfeo_labs" | python3 -c "import json,sys; print(len(json.load(sys.stdin)), 'runs')"Technical Analysis
The Skill embeds a reusable bearer token directly in distributable documentation and command examples. Bearer tokens provide access solely based on possession, so any user or process that can read the installed Skill can recover and reuse this credential without knowing another secret.
The credential is used for both read-only and state-changing Morfeo Engine endpoints. Documented authorized operations include creating runs, regenerating script fields, selecting shots, advancing pipeline stages, inspecting logs, and submitting completed videos to Postiz as drafts. Consequently, the credential has broader authority than is necessary for status-only requests.
The API is documented as listening on
localhost:3336, which limits remote exposure under the stated configuration. Nevertheless, the token remains exposed to local users, compromised processes, agents with file access, and any environment where the service is forwarded, proxied, container-exposed, or rebound to a non-loopback interface.Attack Path
- An attacker, local process, or untrusted agen ...[truncated 1628 chars]
- Remediation
View remediation
Remediation Suggestions
- Immediately rotate and revoke
morfeo-admin-2026, because publishing it in the Skill must be treated as credential disclosure. - Remove the literal token from every documentation example and require it to be supplied through
MORFEO_API_TOKEN:bash : "${MORFEO_API_TOKEN:?MORFEO_API_TOKEN must be set}" H_AUTH="Authorization: Bearer $MORFEO_API_TOKEN" - Store the token in a restricted secret manager or protected environment configuration rather than in the repository, Skill package, shell history, or command-line arguments.
- Replace the shared administrative credential with short-lived, per-user or per-agent credentials.
- Apply endpoint-specific scopes, separating read-only status access, run mutation, operational administration, and publication authorization.
- Require an explicit, separately authorized approval step for publication-related operations, even when the destination is a draft.
- Ensure the API binds exclusively to the loopback interface unless remote access is specifically required. If remote access is needed, place it behind authenticated TLS and network access controls.
- Enforce authorization server-side for every endpoint and validate that callers cannot gain access to another project merely by changing
x-project-id. - Add credential-expiration, audit logging, rate limiting, and anomaly detection for job creation, pipeline advancement, and publication requests.
- Add secret scanning to repository and Skill release workflows to prevent future embedded credentials.
- Immediately rotate and revoke