T09 · Insecure Skill Coding Practices
Error
- Location
- references/habilis_saas_mcp_gateway.md:16
- Finding
- Production Administrative Password Disclosed in Skill Documentation<![CDATA[ ## Vulnerability Details **File Location**: `references/habilis_saas_mcp_gateway.md`, lines 16-17 and 42-52 **Vulnerability Type**: Hardcoded administrative credential **Risk Level**: Critical ### Vulnerable Code ```markdown 1. **Hidden Admin Console**: The `/admin` link is **strictly omitted from the public Navbar/Header** to prevent malicious bot scanning and unauthorized discovery. Access is direct via URL (`https://xvix.com.br/admin`). 2. **Admin Authentication**: Protected by administrative password (`Ramel@2026`). ``` ```env # Stripe Production Keys STRIPE_SECRET_KEY=sk_live_... NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_live_... STRIPE_WEBHOOK_SECRET=whsec_... # App URL & Server Base NEXT_PUBLIC_APP_URL=https://xvix.com.br SERVER_BASE_URL=https://xvix.com.br ADMIN_PASSWORD=Ramel@2026 ``` ### Technical Analysis The project discloses both a publicly reachable administrative endpoint and its purported production password. Omitting an administrative link from navigation is security through obscurity and does not prevent endpoint discovery or direct access. Although the Stripe values are placeholders, `ADMIN_PASSWORD` is presented as a concrete value in both narrative documentation and an environment configuration example. Repository access, package distribution, generated documentation, caches, and repository history can therefore expose the credential. ### Attack Path 1. An attacker downloads or inspects the published Skill package. 2. The attacker discovers the administrative endpoint at `https://xvix.com.br/admin`. 3. The attacker extracts the disclosed password from the documentation. 4. The attacker attempts to authenticate using that password. 5. If the credential is active or reused, the attacker accesses administrative functions and abuses the gateway, Skill-generation, customer, or integration capabilities available there. ### Impact Assessment Successful exploitation could grant administrative access to the Habilis service. The exact ...[truncated 465 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately rotate the disclosed administrative password anywhere it may be active or reused. 2. Remove the password from the current files and purge it from repository history and published package versions. 3. Store administrative credentials in a secret manager or protected runtime environment, never in Skill documentation. 4. Require a unique, randomly generated credential and multifactor authentication for administrative access. 5. Add rate limiting, failed-login monitoring, session expiration, and alerting for the administrative endpoint. 6. Consider restricting the endpoint through an identity-aware proxy, VPN, or network allowlist. 7. Review administrative access logs for attempts involving the disclosed credential. 8. Scan the repository history for additional production credentials and rotate all affected secrets. ]]>