T09 · Insecure Skill Coding Practices
Warning
- Location
- references/operations/get-game-steam-summary.md:27
- Finding
- Steam Web API Key Transmitted in a URL Query Parameter## Vulnerability Details **File Location**: `references/operations/get-game-steam-summary.md`, lines 27-28 and 51 **Vulnerability Type**: Sensitive credential exposure through a query string **Risk Level**: Medium **Relevant source excerpt, rendered in English:** ```markdown > [!IMPORTANT] > **API Key Security** > This endpoint requires a Steam Web API Key. We strongly recommend configuring and invoking it through the backend to avoid exposing it in the client. You may also temporarily provide a key through the `key` query parameter to override the backend configuration. | `key` | query | string | No | Your Steam Web API Key. This optional parameter overrides the globally configured backend key when supplied. It offers greater flexibility, but the key must remain confidential and must not be exposed in the frontend. | ``` ### Technical Analysis The skill documentation permits a Steam Web API key to be supplied through the `key` URL query parameter. Although HTTPS protects the request while it is in transit, it does not prevent the complete URL from being retained after TLS termination. URLs and query strings are commonly captured by: - Web server and reverse-proxy access logs. - API gateways and load balancers. - Application performance monitoring and tracing platforms. - Error reports, debugging output, and request history. - Browser or HTTP client history. - Referrer data in some redirect or browser-based scenarios. Consequently, a request such as `GET /game/steam/summary?key=REDACTED&steamid=...` can cause the credential to be copied into systems with broader access and longer retention periods than an authorized secret store. The warning against frontend disclosure does not eliminate this issue because the documented request format itself places the secret in a log-prone URL component. ### Attack Path 1. A user provides a valid Steam Web API key to perform a Steam profile lookup. 2. The agent follows ...[truncated 1135 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `key` query parameter from the documented and implemented API contract. 2. Accept the credential through a protected request header, such as an authorization header or a dedicated secret header, rather than through the URL. 3. Prefer server-side credential configuration backed by a secret manager so users do not need to submit Steam keys with individual lookup requests. 4. Configure the application, API gateway, reverse proxy, and observability tooling to redact authorization headers and any legacy `key` parameter before logging. 5. Prevent credentials from appearing in error messages, traces, analytics events, request history, and debugging output. 6. Keep Steam API calls on trusted backend infrastructure and prohibit browser-side or other client-side embedding of the key. 7. If compatibility requires temporary support for the query parameter, mark it as deprecated, obtain explicit user consent, warn that the third-party service receives the key, disable URL logging for the endpoint, and provide a migration deadline. 8. Rotate any Steam Web API keys that may already have been transmitted through this query parameter, and review retained logs and traces for prior exposure.