T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:47
- Finding
- External Subagent Delegation Can Expose Cloud Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 47-51 **Vulnerability Type**: Sensitive credential transmission through externally processed task prompts **Risk Level**: High ### Vulnerable Code ```markdown Include all required context in the task string — subagent starts fresh with no memory: - Credentials / endpoints (if needed) - Exact steps to follow - Expected output format - Error handling instructions ``` ### Technical Analysis The Skill explicitly instructs the main agent to place credentials in the `task` string supplied to the Bailian subagent. This prompt is processed outside the main agent's local trust boundary and may be retained in provider logs, request traces, debugging systems, telemetry, or generated output. Secrets should never be embedded in natural-language prompts. The instruction does not require redaction, short-lived credentials, secret references, user confirmation, or restrictions on credential scope. It therefore exceeds the minimum privileges necessary for task delegation: the subagent could receive reusable cloud credentials even where a narrowly scoped server-side tool invocation would be sufficient. The nearby DataWorks example identifies the relevant variables as Alibaba Cloud access credentials: ```python config = Config( access_key_id='${ALICLOUD_ACCESS_KEY_ID}', access_key_secret='${ALICLOUD_ACCESS_KEY_SECRET}', endpoint='dataworks.cn-hangzhou.aliyuncs.com', region_id='cn-hangzhou' ) ``` These are placeholders rather than literal credentials, but the preceding instruction encourages resolving or copying such credentials into externally transmitted task text. ### Attack Path 1. A user or attacker causes the Skill to delegate a DataWorks or MaxCompute operation. 2. Following the Skill instructions, the main agent includes the required endpoint and cloud credentials in the `sessions_spawn` task string. 3. The task prompt is transmitte ...[truncated 1106 chars]
- Remediation
- ## Remediation Suggestions - Remove the instruction to include credentials in the subagent task string. - Never expose access keys, session tokens, passwords, or other secrets to model prompts or outputs. - Execute authenticated operations through a trusted server-side tool that resolves credentials internally and never returns them to either agent. - Use short-lived, operation-specific credentials when delegation is unavoidable. - Restrict credentials to the required project, datasource, API actions, and time window. - Pass opaque secret references or approved tool handles instead of secret values. - Add automatic prompt and output redaction for access keys, tokens, and environment-variable values. - Require explicit user confirmation before transmitting any potentially sensitive context to an external model provider. - Ensure provider-side prompt logging and retention are disabled or minimized where supported. - Rotate any credentials that may previously have been sent through this workflow and review cloud audit logs for unauthorized use.