T09 · Insecure Skill Coding Practices
- Location
billing.py:11- Finding
Hard-Coded Billing API Credential Exposed in Distributed Source Code
- Content
View full analysis
Vulnerability Details
File Location:
billing.py, lines 11–17
Vulnerability Type: Hard-coded secret and insecure credential management
Risk Level: Highpython BILLING_URL = "https://skillpay.me/api/v1/billing" API_KEY = "sk_72df482063c0d454184ac7677a9f1094638da3e9f9b51530c9ffab92d0427011" SKILL_ID = "quant-orchestrator" HEADERS = { "X-API-Key": API_KEY, "Content-Type": "application/json" }The exposed credential is subsequently attached to billing requests:
python response = requests.post( f"{BILLING_URL}/charge", json={ "user_id": user_id, "skill_id": SKILL_ID, "amount": 0.1 }, headers=HEADERS, timeout=10 )Technical Analysis
A live-looking billing API key is embedded directly in source code distributed with the Skill. Source-level secrets cannot be kept confidential because every user or system with access to the package can read, copy, and reuse them outside the intended application.
The credential is included in the
X-API-Keyheader for charge, balance, and payment-link requests. The billing functions also transmit caller-provideduser_idvalues tohttps://skillpay.me/api/v1/billing. Sending a user identifier may be necessary for billing, but distributing a privileged service credential is not required and violates least-secret and secure credential-management principles.The code does not demonstrate that the key is short-lived, restricted to a specific user, or otherwise protected against replay. The exact operations available to an attacker depend on server-side authorization, which was not established during this static audit.
Attack Path
- An attacker downloads or otherwise obtains the Skill package.
- The attacker opens
billing.pyand extracts the hard-coded API key and billing endpoint. - The attacker constructs requests using the exposed key in the
X-API-Keyheader. - The ...[truncated 893 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke and rotate the exposed API key immediately; assume it has already been compromised.
- Remove all credentials from source code and repository history.
- Keep privileged billing operations in a trusted server-side component rather than distributing the credential with the Skill.
- Load secrets from a managed secret store or protected environment variable when server-side use is unavoidable.
- Use short-lived, narrowly scoped credentials that permit only the required billing operation.
- Require independent authorization binding each request to the authenticated user instead of trusting a caller-supplied
user_id. - Add rate limiting, replay protection, audit logging, anomaly detection, and transaction limits to the billing service.
- Document the transfer of user identifiers to the external billing provider and obtain any consent required by the deployment environment.
- Add automated secret scanning to development and release pipelines.