T09 · Insecure Skill Coding Practices
Error
- Location
- skill.md:72
- Finding
- Unsafe Handling and Storage of Wallet and API Credentials## Vulnerability Details **File Location**: `skill.md`, lines 72-85 **Vulnerability Type**: Exposure and insecure persistence of sensitive credentials **Risk Level**: High ### Vulnerable Code ```markdown **IMPORTANT — you MUST do all of the following after registration:** 1. **Show the `privateKey` to your human user immediately.** This is their wallet key — they need it to withdraw funds. It is shown this one time only and cannot be recovered. 2. **Show the `publicKey`** — this is the Solana wallet address they need to fund with SOL. 3. **Save the `apiKey` in your memory** — you need it for all requests. Never show it publicly. 4. **Do NOT register again** if you already have an API key. Check your memory/storage first before calling register. **Tell your human:** > "Here is your wallet private key: `[privateKey]`. Save it securely — it will never be shown again. Send SOL to `[publicKey]` to start trading." Store the apiKey in your memory, environment variables (`PLUGY_API_KEY`), or `~/.config/plugy/credentials.json`. ``` ### Technical Analysis The Skill instructs the agent to place a Solana wallet private key directly into conversational output. Agent conversations may be retained in logs, model context, monitoring systems, browser history, or third-party integrations. Consequently, a high-value private key is exposed to substantially more components than are required to operate the wallet. The API key may also be stored in persistent agent memory, an environment variable, or a local credential file. The instructions do not require file permissions such as `0600`, encryption at rest, an operating-system secret manager, log redaction, credential expiration, or rotation. Persistent agent memory is especially unsuitable for secrets because it may be included in future contexts or exposed to other tools. Environment variables can be inherited by child processes, while a file created with permissive defaults may be accessibl ...[truncated 1444 chars]
- Remediation
- ## Remediation Suggestions - Do not place wallet private keys in model context, ordinary chat output, logs, or persistent agent memory. - Provide a dedicated secret-export mechanism that delivers the private key directly to an authenticated user through a secure, non-logged channel. - Store API keys in an operating-system keychain, hardware-backed keystore, or dedicated secret manager. - If file storage is unavoidable, create the parent directory and credential file atomically with owner-only permissions, such as directory mode `0700` and file mode `0600`. - Avoid environment-variable storage where untrusted child processes or diagnostic tooling can inspect the process environment. - Implement comprehensive secret redaction for request logs, responses, telemetry, errors, and conversation transcripts. - Use narrowly scoped, revocable API credentials with expiration, transaction limits, and separate permissions for reading, trading, and withdrawals. - Document immediate credential rotation and revocation procedures. - Require explicit user confirmation before any action that transfers assets or exposes wallet recovery material.