T09 · Insecure Skill Coding Practices
Error
- Location
- references/client-supplied-credentials.md:10
- Finding
- Provider API Credentials Are Transmitted Through a Third-Party Gateway Despite Local-Only Security Claims<![CDATA[ ## Vulnerability Details **File Location**: `references/client-supplied-credentials.md:10-13`; contradictory security claim at `README.md:48` **Vulnerability Type**: Provider credential disclosure across a third-party trust boundary **Risk Level**: High ### Vulnerable Code Snippet ```markdown 2. **Target Provider API Keys & Tokens (`OPENAI_ADS_API_KEY`, `META_ACCESS_TOKEN`, etc.)**: - **MUST be held locally by the client/agent** (in `.env`, local Hermes environment, Claude Desktop config, or Cursor environment). - Passed on demand as arguments in tool invocations (e.g. `openai_api_key: "sk-..."`, `meta_access_token: "EAAB..."`). - **NEVER persisted or stored** in Habilis databases. Calls are executed statelessly and ephemerally. ``` The README additionally makes the following conflicting claim: ```markdown - 🔒 **Zero-Storage Stateless Architecture**: Credentials remain exclusively on your local machine. ``` ### Technical Analysis The Skill instructs users to retain provider API credentials locally but then pass those credentials as MCP tool arguments. Because the MCP service is configured at the remote Habilis gateway, tool arguments are transmitted outside the local environment and become observable by that gateway. A stateless or zero-storage design does not eliminate this exposure. Even if the remote service does not intentionally persist credentials, it must receive and process them. Secrets may consequently be exposed through: - Application, proxy, or observability logs. - Request tracing and error-reporting systems. - Compromise of the gateway or its infrastructure. - Malicious or unauthorized gateway operators. - Memory inspection while requests are processed. - Accidental forwarding to other downstream services. The assertion that credentials remain exclusively on the local machine is therefore inconsistent with the documented invocation architecture. The repository contains no implementation or independently verifiable cont ...[truncated 1765 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Do not send long-lived provider secrets through the gateway** - Make provider API calls directly from the user's trusted environment where supported. - Keep provider credentials out of MCP arguments, prompts, model context, and generated command text. 2. **Use delegated authorization** - Adopt provider-hosted OAuth authorization flows. - Use short-lived, narrowly scoped access tokens rather than long-lived API keys. - Bind tokens to the minimum required account, operation, and duration. 3. **Separate gateway and provider credentials** - The Habilis platform token should authenticate only to Habilis. - Provider credentials should not be reusable by Habilis outside a narrowly authorized delegated operation. 4. **Accurately document the trust boundary** - Replace the claim that credentials remain exclusively local. - Explicitly state which credentials are transmitted, which systems process them, and which subprocessors may receive them. - Obtain informed user consent before transmitting a provider credential. 5. **Prevent secret retention and leakage** - Redact credentials from application logs, reverse-proxy logs, traces, analytics, crash reports, and MCP transcripts. - Disable request-body recording for credential-bearing endpoints. - Prevent secrets from being included in model-visible context or tool-call history. - Enforce memory clearing and strict retention limits where technically possible. 6. **Constrain credential impact** - Require least-privilege scopes and account-level restrictions. - Prefer tokens that cannot manage billing or unrelated business assets. - Require explicit user confirmation before campaign activation, budget changes, or other spending operations. - Enforce server-side budget ceilings and anomaly detection. 7. **Support incident response** - Provide credential rotation and revocation procedures. - Notify users of suspected gateway o ...[truncated 137 chars]