T09 · Insecure Skill Coding Practices
Error
- Location
scripts/api_key.py:187- Finding
Caller-Controlled Description Can Trigger Deletion of Unrelated Cloud API Keys
- Content
View full analysis
tuple[str, str]: ``` ```python if not _retry: existing_keys = _list_cloud_api_keys(workspace_id) orphans = [k for k in existing_keys if description in k.get("description", "")] for orphan in orphans: orphan_id = str(orphan.get("apiKeyId", "")) if orphan_id: print(f" Cleaning up orphan key from previous attempt: ID={orphan_id}", file=sys.stderr) _delete_cloud_api_key(orphan_id) ``` The API-key-limit recovery path repeats the same unsafe ownership test: ```python if not _retry and ("Limit" in stderr or "limit" in stderr.lower()): print("Warning: API Key count has reached the limit. Attempting to recycle old keys from this skill...", file=sys.stderr) existing_keys = _list_cloud_api_keys(workspace_id) # Only recycle keys created by this skill (matched by description), never touch other keys recyclable = [k for k in existing_keys if description in k.get("description", "")] if recyclable: old_key_id = str(recyclable[0].get("apiKeyId", "")) old_key_desc = recyclable[0].get("description", "") if old_key_id: print(f" Found recyclable old key: ID={old_key_id}, description='{old_key_desc}'", file=sys.stderr) delete_result = _delete_cloud_api_key(old_key_id) if delete_result["success"]: print(f"Old key recycled (ID: {old_key_id}). Recreating...", file=sys.stderr) return generate_api_key(description, _retry=True) ``` ### Technical Analysis The public `generate_api_key()` function accepts a ...[truncated 2345 chars]- Remediation
View remediation