T09 · Insecure Skill Coding Practices
- Location
SKILL.md:114- Finding
Plaintext Credential Collection, Storage, and Exposure Through Tool Arguments
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:114-115, 235, 273, 307;references/channel-strategy.md:104-116, 206-211
Vulnerability Type: Plaintext secret handling and potential credential disclosure
Risk Level: MediumRelevant Code
SKILL.md:273:text 5. **NGA login** (if enabled) — Read credentials from `{WORKSPACE}/game-sentiment-data/.credentials/accounts.json`, use Playwright iframe DOM manipulation + captcha screenshot + AI recognition.references/channel-strategy.md:108-115:javascript (el) => { const doc = el.contentDocument; const inputs = doc.querySelectorAll('input[type="text"], input[type="password"], input:not([type])'); inputs[0].value = USERNAME; inputs[0].dispatchEvent(new Event('input', {bubbles:true})); inputs[1].value = PASSWORD; inputs[1].dispatchEvent(new Event('input', {bubbles:true})); }references/channel-strategy.md:206-211:text 1. Search videos: GET https://www.googleapis.com/youtube/v3/search?part=snippet&q={query}&type=video&order=date&maxResults=10&key={API_KEY} 3. Retrieve video details: GET https://www.googleapis.com/youtube/v3/videos?part=statistics,snippet&id={videoId}&key={API_KEY} 4. Retrieve comments: GET https://www.googleapis.com/youtube/v3/commentThreads?part=snippet&videoId={videoId}&maxResults=20&order=relevance&key={API_KEY}The setup instructions at
SKILL.md:114-115additionally direct the user to provide the YouTube API key and NGA username and password through the conversation so that the Agent can store them. The documented destination is the plaintext workspace file.credentials/accounts.json.Technical Analysis
The Skill treats long-lived authentication secrets as ordinary workspace data. It does not require an operating-system keychain, platform secret manager, encrypted credential store, or restrictive file permissions. Merely placing the file in a directory named
.credentialsor excluding ...[truncated 2318 chars]- Remediation
View remediation
Remediation Suggestions
- Replace
.credentials/accounts.jsonwith the platform's secret manager, operating-system keychain, or another encrypted credential facility. - Do not ask users to paste passwords or API keys into ordinary conversation messages. Use a dedicated secret-input mechanism that prevents values from entering chat history.
- If file-based storage is unavoidable:
- Create the credential file with owner-only permissions.
- Reject execution when permissions are broader than required.
- Keep credentials outside report, raw-data, archive, and backup directories.
- Encrypt secrets at rest with a key not stored beside the ciphertext.
- Ensure secrets are redacted from tool calls, browser-evaluation traces, exceptions, progress messages, reports, and diagnostic logs.
- Use scoped and revocable credentials. Restrict the YouTube key by API, project, quota, and permitted request origin where supported.
- Avoid placing API keys in logged URLs. Use authorization headers where the service supports them; otherwise configure URL and telemetry redaction explicitly.
- Prefer a session token or isolated service account over reuse of the user's primary NGA password.
- Document credential deletion, rotation, expiration, and incident-response procedures.
- Replace