T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:74
- Finding
- Long-Lived API Credential Exposed in an MCP Endpoint URL<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 74–83 **Vulnerability Type**: API credential exposure through a URL query parameter **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "sanctifai": { "url": "https://app.sanctifai.com/mcp?access_token=sk_live_xxx" } } } ``` ```markdown **Protocol:** Streamable HTTP transport with SSE for real-time notifications. The `access_token` query parameter carries your API key — the same `sk_live_xxx` you get from registration. ``` ### Technical Analysis The documented MCP configuration places a long-lived API key in the `access_token` query parameter. Query strings are routinely captured by configuration files, reverse proxies, request logs, diagnostic output, telemetry systems, error reports, URL parsers, and copied connection strings. Although HTTPS protects the URL while it is in transit, it does not prevent endpoint components or local tooling from recording the complete URL. This unnecessarily expands the number of places in which the credential may persist. The REST integration described elsewhere in the Skill uses an `Authorization: Bearer` header, demonstrating that a less exposed credential transport pattern is available. This exceeds minimum privilege in terms of credential exposure: every component handling the MCP URL receives access to a bearer credential even if that component only needs endpoint routing information. ### Attack Path 1. A user follows the Skill instructions and configures the MCP server with an actual API key in the URL. 2. An MCP client, proxy, monitoring integration, support bundle, or configuration backup records the complete endpoint URL. 3. An attacker obtains access to that record through a leaked configuration, diagnostic report, log aggregation system, or copied URL. 4. The attacker extracts the `access_token` value. 5. The attacker connects to the SanctifAI MCP endpoint using the stolen bearer credential. 6. The attac ...[truncated 939 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove API credentials from MCP endpoint query strings. 2. Transmit the credential through an `Authorization: Bearer` header or a dedicated protected authentication field supported by the MCP client. 3. Reference the credential through an environment variable or operating-system secret store rather than embedding it directly in configuration. 4. Ensure logs, telemetry, exception reports, and support bundles redact authorization values. 5. Document immediate key rotation when a configuration file or endpoint URL may have been disclosed. 6. Provide server-side revocation, expiration, and narrowly scoped tokens for MCP access. 7. If query-parameter authentication must temporarily remain supported, issue short-lived, single-purpose connection tokens rather than reusable agent API keys. ]]>