T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:8
- Finding
- Authentication Token Embedded in MCP Connector URL## Vulnerability Details **File Location**: `SKILL.md`, lines 8-32 **Vulnerability Type**: Credential exposure through a token-bearing URL **Risk Level**: Medium The Skill requires users to copy a URL containing an embedded authentication token into an external connector. Although this behavior is disclosed and the token is described as read-only, placing credentials in URLs increases the likelihood that they will be exposed through configuration storage, application logs, telemetry, browser history, screenshots, clipboard history, referrer data, or support diagnostics. ### Vulnerable Code Snippet ```markdown homepage: https://boring-doc.aiagent-me.com/getting-started/mcp.html requires: config: - MCP Connector link from boring.aiagent-me.com (contains embedded auth token) --- # Facebook Analytics Track your Facebook Page performance — reach, engagement, video views, and post-level metrics. Powered by [Boring](https://boring-doc.aiagent-me.com). ## Security & Data Handling - **MCP link is a credential**: Your MCP Server URL (`https://boring.aiagent-me.com/mcp/t/xxxxx...`) contains an embedded authentication token. Treat it like a password — do not share it publicly. - **Token scope**: The embedded token is **read-only** for analytics. It can only fetch performance metrics and account metadata. It cannot publish, delete, or modify any content on your social media accounts. - **Token storage**: The token is stored server-side in Boring's database (MongoDB on DigitalOcean). It is never written to your local filesystem. You can regenerate or revoke it anytime at [boring.aiagent-me.com/settings](https://boring.aiagent-me.com/settings). - **Data flow**: Analytics queries are sent from Boring's server (Google Cloud, us-central1) to the platform's API on your behalf. Only performance metrics are retrieved — no content is uploaded or modified. - **No local credentials**: No local API keys, environment ...[truncated 3648 chars]
- Remediation
- ## Remediation Suggestions 1. Replace authentication tokens embedded in URL paths with an `Authorization: Bearer` header or a connector-specific secret field that is never displayed as part of an endpoint URL. 2. Use short-lived access tokens and a refresh or reauthorization flow rather than long-lived reusable URLs. 3. Bind each token to the minimum required read-only analytics permissions, specific Facebook Pages, and explicitly permitted MCP methods. 4. Ensure the connector UI, server access logs, reverse proxies, telemetry, analytics systems, and error reports redact authentication values. 5. Prevent tokens from appearing in browser history, referrer headers, screenshots, copied diagnostic output, and user-visible error messages. 6. Store connector credentials in an encrypted secret store with access controls rather than ordinary configuration or plaintext files. 7. Provide token expiration, immediate revocation, rotation, active-session visibility, and audit logs for token usage. 8. Document where connector credentials are stored and processed, their lifetime and precise authorization scope, and applicable retention and deletion policies. 9. Add server-side authorization checks for every request rather than relying solely on possession of the MCP URL. 10. Alert users to suspicious token use, including access from new locations, unusual request rates, or attempts to call methods outside the permitted scope.