T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:455
- Finding
- Plaintext Disclosure of the Maton API Key## Vulnerability Details **File Location**: `SKILL.md`, line 455 **Vulnerability Type**: Plaintext sensitive credential exposure **Risk Level**: Medium **Complete Code Snippet**: ```bash echo $MATON_API_KEY ``` ### Technical Analysis The troubleshooting instructions print the complete `MATON_API_KEY` bearer credential to standard output. Displaying a secret is unnecessary for determining whether the environment variable is configured. The exposed value may persist in terminal scrollback, agent tool output, CI/CD logs, shell-session recordings, debugging captures, or support transcripts. The project uses this credential in the `Authorization` header for `gateway.maton.ai` and `ctrl.maton.ai`, making possession of the value sufficient to authenticate to those services within the key's authorized scope. The documented third-party network communication itself is disclosed and necessary for the Skill's managed OAuth proxy architecture. The vulnerability is specifically the unnecessary plaintext display of the credential. ### Attack Path 1. A user or agent encounters an authentication problem and follows the troubleshooting instructions. 2. `echo $MATON_API_KEY` prints the complete bearer credential. 3. The output is retained in terminal scrollback, agent logs, CI logs, a session recording, or material shared with support. 4. An attacker or unauthorized operator obtains access to that retained output. 5. The attacker inserts the exposed value into an `Authorization: Bearer` header. 6. The attacker authenticates to the documented Maton gateway or connection-management endpoints. 7. Subject to the API key's permissions and connected Microsoft OAuth scopes, the attacker accesses or modifies Outlook resources or connection state. ### Impact Assessment Successful exploitation may allow impersonation of the API-key holder against Maton services. Depending on the key's authorization scope and active Outlook connections, pot ...[truncated 519 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the command that prints the credential. 2. Test only whether the variable is populated: ```bash if [ -n "${MATON_API_KEY:-}" ]; then echo "MATON_API_KEY is set" else echo "MATON_API_KEY is not set" fi ``` 3. Avoid printing, logging, tracing, or including the key in diagnostic reports. 4. Add explicit guidance that users must redact authorization headers and credentials before sharing logs or terminal output. 5. Advise immediate rotation of any key previously printed into retained or shared output. 6. Where supported, use narrowly scoped, short-lived, and revocable credentials and restrict the associated Microsoft OAuth scopes to those required by the task. 7. Ensure logging systems redact values associated with `MATON_API_KEY` and `Authorization` headers.