T09 · Insecure Skill Coding Practices
Error
- Location
- config.json:1
- Finding
- AgentMail API credential committed in plaintext<![CDATA[ ## Vulnerability Details **File Location**: `config.json:1`; duplicate disclosure in `SKILL.md:7-13` **Vulnerability Type**: Hardcoded secret and plaintext sensitive configuration **Risk Level**: High ### Vulnerable Code ```json {"email": "swaudiobrain@agentmail.to", "smtp_server": "email-smtp.eu-central-1.amazonaws.com", "smtp_port": 587, "username": "AKIA...", "password": "...", "api_key": "am_us_9c78f14e6adbd64bae61ad49513bd13d7e0c3b7ff9002a6b8651c58b386165fc"} ``` `SKILL.md:7-13` additionally identifies an absolute credential-file path and repeats the same AgentMail API key in an environment-variable example. ### Technical Analysis The project embeds a complete, active-looking AgentMail bearer token in distributable configuration and documentation. Anyone who can read the project can extract the credential without needing access to the referenced `.env.agentmail` file. Bearer tokens normally grant access based solely on possession. Embedding one in a Skill therefore transfers its associated permissions to every recipient of the package. The absolute secret path also reveals local workspace structure and encourages direct access to a user-specific credential file. This behavior contradicts the README's own recommendation to keep API keys in runtime environment variables. The SMTP username and password in `config.json` appear to be placeholders rather than confirmed credentials. The AgentMail API key, however, is fully populated and duplicated. ### Attack Path 1. An attacker obtains the Skill package, repository contents, build artifact, or a copy of the audit target. 2. The attacker reads `config.json` or `SKILL.md`. 3. The attacker extracts the hardcoded AgentMail bearer token. 4. The attacker submits the token in an `Authorization: Bearer` header to the AgentMail API. 5. Any operations permitted by the token can then be performed until the credential is revoked or expires. ### Impact Assessment The attacker may acquire the AgentMail per ...[truncated 436 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed AgentMail key immediately; deletion from the current files alone is insufficient. 2. Remove the key from `config.json`, `SKILL.md`, version-control history, release artifacts, logs, and caches. 3. Accept credentials only through runtime secret injection, such as a protected environment variable or approved secret manager. 4. Replace committed configuration with a non-sensitive template such as: ```json { "email": "example@agentmail.to", "smtp_server": "email-smtp.eu-central-1.amazonaws.com", "smtp_port": 587 } ``` 5. Remove the user-specific absolute `.env.agentmail` path from the documentation. 6. Apply least-privilege API scopes, short expiration periods, and usage monitoring where supported. 7. Add automated secret scanning and pre-commit checks to prevent recurrence. ]]>