T09 · Insecure Skill Coding Practices
- Location
SKILL.md:435- Finding
Credential Values Are Exposed in Audit Output and CI Logs
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 435–466
Vulnerability Type: Sensitive information exposure through diagnostic output
Risk Level: HighVulnerable Code
python if AWS_KEY_RE.search(line): findings.append(Finding( check_id="IC003", severity="CRITICAL", location=f"{filepath}:{i + 1}", resource="<credentials>", message=f"AWS access key hardcoded: {line.strip()[:60]}", fix="Use aws_secretsmanager_secret_version, AWS SSM Parameter Store, or environment variables. Never commit keys.", )) continue m = HARDCODED_CRED_RE.search(line) if m: # Skip lines that reference variables or data sources if re.search(r'(var\.|data\.|local\.|aws_secretsmanager|aws_ssm_parameter|\$\{)', line): continue # Skip obvious non-secret patterns val_match = re.search(r'=\s*"([^"]+)"', line[m.start():]) if val_match: val = val_match.group(1) # Skip: ARNs, region names, account IDs (12-digit), resource names, hostnames if re.match(r"(arn:|[a-z]+-[a-z]+-[12]$|\d{12}$|[a-z0-9-]+\.[a-z]+$)", val, re.IGNORECASE): continue if len(val) < 6: # Too short to be a real credential continue findings.append(Finding( check_id="IC003", severity="CRITICAL", location=f"{filepath}:{i + 1}", resource="<credentials>", message=f"Possible hardcoded credential: {line.strip()[:70]}", fix="Use var.db_password from terraform.tfvars (gitignored) or aws_secretsmanager_secret_version data source.", ))Technical Analysis
The credential scanner copies up to 60 or 70 characters from the source line into each finding rather than redacting the detected value. The report formatter subsequently prints the finding message. Because the documented workflow includes CI execution, these mess ...[truncated 2073 chars]
- Remediation
View remediation
Remediation Suggestions
-
Never include the original source line or matched credential value in a finding.
-
Report only non-sensitive metadata, such as the file, line number, detected credential type, and configuration key name.
-
Replace values with a fixed marker rather than length-preserving partial masking. For example:
python message="Possible hardcoded credential detected in assignment; value redacted." -
If the configuration key is needed, extract and strictly validate only the key name:
python key_match = re.search( r'^\s*(password|secret|access_key|secret_key|token|api_key|private_key)\s*=', line, re.IGNORECASE, ) key_name = key_match.group(1) if key_match else "credential" message=f"Possible hardcoded {key_name} detected; value redacted." -
Apply redaction before constructing
Findingobjects so secrets cannot leak through alternative formatters or future output modes. -
Add automated tests using synthetic AWS keys, passwords, tokens, multiline private keys, and long secrets. Assert that neither complete values nor prefixes appear in formatted output.
-
Configure CI systems to restrict access to historical logs and shorten retention. Treat existing logs produced by affected versions as potentially sensitive.
-
Rotate any real credential previously processed and printed by the scanner, then invalidate the old credential and review its service audit logs for unauthorized use.
-