T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:37
- Finding
- Insecure Plaintext Persistence of Orb API Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 37–49 **Vulnerability Type**: Plaintext credential storage and unsafe configuration modification **Risk Level**: Medium ### Vulnerable Code ```markdown Before making any API call, check that `$ORB_API_KEY` is set. If it is not: 1. Ask the user for their Orb API key: > I need your Orb API key to create artifacts. > Get one at **https://byorb.app/dashboard/settings** → **Create API Key** 2. Once the user provides the key, **persist it** so it survives across sessions. Use your native configuration mechanism: - **Claude Code**: Add to `~/.claude/settings.json` under `"env": { "ORB_API_KEY": "..." }` - **Gemini CLI**: Write to `~/.gemini/.env` as `ORB_API_KEY=...` - **Codex**: Add to `~/.codex/config.toml` under `[shell_environment_policy]` with `set = { ORB_API_KEY = "..." }` - **Fallback**: Append `export ORB_API_KEY=...` to the user's shell profile (`~/.zshrc` or `~/.bashrc`) 3. Also `export ORB_API_KEY=...` in the current session so it's available immediately. ``` ### Technical Analysis The Skill explicitly requires an Agent to persist `ORB_API_KEY` in plaintext configuration files, dotenv files, or shell startup files. Persistent storage is not required for the declared operation of submitting artifacts to the Orb API; a process-scoped or session-scoped environment variable is sufficient. The instructions do not require: - Explicit user consent before persistent storage. - Use of an operating-system credential manager or secret vault. - Restrictive owner-only permissions on credential files. - Validation or safe encoding of the supplied credential. - Protection against symlink attacks when writing configuration files. - Secure removal or API-key revocation procedures. The shell-profile fallback is particularly risky. Files such as `~/.zshrc` and `~/.bashrc` are interpreted whenever a new shell starts. If an Agent directly interpolates an untrusted key into a ...[truncated 2612 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Use session-scoped credentials by default** - Accept `ORB_API_KEY` only from the existing process environment. - If absent, instruct the user to configure it outside the Skill or use it only for the current process. - Do not automatically modify persistent files. 2. **Require explicit consent for persistence** - Clearly identify the destination file, persistence duration, and disclosure risks. - Obtain confirmation before writing any credential to disk. 3. **Use a secure credential store** - Prefer an operating-system keychain, platform secret manager, or Agent-native encrypted credential facility. - Store only a secret reference in ordinary configuration files. 4. **Protect any unavoidable credential file** - Create it with owner-only permissions, such as mode `0600`. - Verify that the destination and its parent directories are owned by the expected user. - Reject symbolic links and use atomic file replacement where appropriate. - Avoid placing secrets in shell startup files. 5. **Prevent injection and configuration corruption** - Do not generate shell commands by concatenating the supplied key. - Use structured JSON or TOML serializers for configuration files. - If shell representation is unavoidable, validate the expected token format and apply robust shell escaping through a trusted mechanism. 6. **Support credential lifecycle management** - Document where the key is stored. - Provide removal and rotation instructions. - Recommend immediate revocation if the key may have been disclosed. ]]>