T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:19- Finding
Unsafe Recommendation to Persist an Access Token in a Plaintext Documentation File
- Content
View full analysis
` Tips: You can save the key in `TOOLS.md` for future reference. ``` ### Technical Analysis The Skill recommends saving the PopAI access token in `TOOLS.md`. This is a plaintext documentation file rather than a protected credential store. It may be committed to source control, copied into support bundles, indexed by development tools, included in backups, or made readable to other users and agents with access to the project. Although the script itself correctly reads the credential from the `POPAI_ACCESS_TOKEN` environment variable, the additional persistence recommendation undermines that safer mechanism. A long-lived API token should not be stored in repository documentation. ### Attack Path 1. A user follows the Skill instructions and writes the PopAI access token into `TOOLS.md`. 2. The file is committed to a repository, synchronized to cloud storage, included in an archive, exposed through logs or support tooling, or read by another local user or agent. 3. An unauthorized party extracts the token. 4. The party submits authenticated requests to the PopAI API under the victim's account. 5. The exposed token remains usable until it expires or is explicitly revoked. No direct automated credential theft is present in the audited code; exploitation depends on the user following the unsafe storage recommendation and the resulting file becoming accessible. ### Impact Assessment An exposed token could permit unauthorized use of the PopAI account within the permissions granted to that token. Potential effects include unauthorized API consumption, quota or billing impact, generation of p ...[truncated 272 chars]- Remediation
View remediation