T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:90
- Finding
- Exchange API Credentials May Be Disclosed Through Agent Conversation## Vulnerability Details **File Location**: `SKILL.md:90-95` **Vulnerability Type**: Sensitive credential exposure **Risk Level**: Medium **Complete Code Snippet**: ```markdown Present the user with exactly these two options, neutrally (do NOT label OAuth as "recommended"): 1. **Replace the API key** — the user generates a new key on the OKX web console (`https://<site>/account/my-api`) and either provides `AK/SK/PP` to you or re-runs `okx config init` themselves. 2. **Switch entirely to OAuth** — first remove the broken API-key profile (`okx config use <other-profile>` or delete the profile block in `~/.okx/config.toml`), THEN run the OAuth login flow from Step 0.3. ``` ### Technical Analysis The instruction explicitly permits a user to provide an API key, secret key, and passphrase—identified as `AK/SK/PP`—directly to the Agent. These values are authentication secrets capable of granting access to an exchange account according to the permissions assigned to the API key. Entering these credentials into an Agent conversation can expose them to chat history, application telemetry, model context, tool integrations, debugging records, or other logging infrastructure. The Skill does not define a secure secret-entry mechanism, prohibit credential persistence, require redaction, or ensure that these values remain outside the conversation transcript. No intentional credential exfiltration is present in the reviewed file. The vulnerability is an insecure credential-handling practice rather than confirmed malicious behavior. ### Attack Path 1. An existing OKX API key fails with an authentication or signature error. 2. The Skill presents replacement of the API key as an option. 3. Following the instruction, the user submits the new API key, secret key, and passphrase to the Agent. 4. The credentials become part of the conversation or associated application logs. 5. A party with unauthorized access to those records ...[truncated 747 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction allowing users to provide `AK/SK/PP` to the Agent. 2. Require users to enter credentials only through `okx config init` or an equivalent trusted local interactive prompt that does not echo values into chat. 3. Prefer OAuth device authorization where appropriate because it avoids transmitting primary API credentials through the Agent. 4. Add an explicit warning that API keys, secret keys, passphrases, refresh tokens, and session tokens must never be pasted into a conversation. 5. Ensure the CLI masks secret input and never emits credentials through standard output, error output, telemetry, or debug logs. 6. Support operating-system credential stores or a dedicated secret manager instead of plaintext configuration where feasible. 7. Document credential rotation and immediate revocation procedures for users who have already disclosed credentials.