T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:599- Finding
API Key Disclosed Through Terminal Output
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:599-605
Vulnerability Type: Sensitive credential exposure
Risk Level: MediumVulnerable Code:
markdown ### Troubleshooting: API Key Issues 1. Check that the `MATON_API_KEY` environment variable is set: ```bash echo $MATON_API_KEYtext ### Technical Analysis The troubleshooting command prints the complete `MATON_API_KEY` bearer credential to standard output. Although this does not directly transmit the key over the network, terminal output is frequently retained in CI/CD logs, shell transcripts, support records, screen recordings, agent conversation histories, or shared screenshots. Possession of the key may allow an unauthorized party to authenticate to the documented Maton control and gateway endpoints. This disclosure is unnecessary because troubleshooting only needs to determine whether the variable is present, not reveal its value. The other documented uses of the key send it through an HTTPS `Authorization` header to `gateway.maton.ai` or `ctrl.maton.ai`. That network behavior is disclosed and necessary for the Skill's managed OAuth proxy functionality. No evidence was found that the credential is sent to an unrelated endpoint. ### Attack Path 1. An operator encounters an authentication problem and follows the documented troubleshooting procedure. 2. The operator runs `echo $MATON_API_KEY`. 3. The complete bearer key appears in terminal output. 4. The output is retained in a CI log, agent transcript, screen recording, screenshot, or support ticket. 5. An attacker or unauthorized viewer obtains the retained output and extracts the key. 6. The attacker supplies the key in an `Authorization: Bearer` header to Maton endpoints. 7. Subject to the key's server-side permissions and connected accounts, the attacker can access WhatsApp Business operations or connection-management functions. ### Impact Assessment A leaked key could per ...[truncated 655 chars]- Remediation
View remediation
Remediation Suggestions
Replace the secret-printing command with a presence check that never displays the credential:
bash if [ -n "${MATON_API_KEY:-}" ]; then echo "MATON_API_KEY is set" else echo "MATON_API_KEY is not set" fiAdditional hardening measures:
- Never print, log, or include the full API key in diagnostics, support tickets, screenshots, or error messages.
- If partial identification is necessary, use a provider-issued non-secret key identifier rather than exposing any portion of the bearer token.
- Redact
Authorizationheaders in HTTP debugging, CI logs, and agent transcripts. - Rotate the key immediately if it has already appeared in retained output.
- Use narrowly scoped, revocable credentials where supported.
- Document key revocation and incident-response procedures.
- Ensure network requests continue to use HTTPS and restrict credential transmission to the intended Maton domains.