T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:117
- Finding
- Plaintext Database Credentials Embedded in Skill Documentation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:117-122` **Vulnerability Type**: Hard-coded secret exposure **Risk Level**: High ### Vulnerable Code ```json "db_fixture": { "connection": { "host": "10.115.96.247", "port": 3306, "user": "jxindependent", "password": "Xj2zCkLJXTkEJ5j", "database": "jxindependent0", "charset": "utf8mb4" }, ``` ### Technical Analysis The skill documentation contains a concrete internal database address, username, database name, and plaintext password. These are not presented as generic placeholders, unlike values such as `db_user` and `db_password` elsewhere in the project. Secrets committed to documentation are exposed to every user, artifact system, source-code mirror, backup, and log with access to the package. Removing the credential in a later revision is insufficient if previous versions remain in source-control history or artifact caches. ### Attack Path 1. An attacker obtains the skill package, a repository copy, or a cached artifact. 2. The attacker reads `SKILL.md` and extracts the database host, username, password, and database name. 3. The attacker attempts to reach the internal database directly, through a compromised internal host, or through an available network tunnel. 4. If the credential remains valid, the attacker authenticates to MySQL. 5. The attacker accesses or modifies any database resources permitted to that account. ### Impact Assessment Successful exploitation grants the privileges assigned to the exposed database account. Depending on its grants, this could include disclosure of invoice or customer records, modification or deletion of business data, enumeration of database structure, and access to additional secrets stored in the database. Password reuse could extend the compromise to other services. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed database password. 2. Review authentication and database audit logs for use of the exposed account. 3. Replace all concrete connection information with unmistakable placeholders. 4. Store credentials in environment variables or an approved secret manager rather than test configurations or documentation. 5. Create a dedicated read-only fixture account restricted to the required schema, tables, source networks, and query operations. 6. Scan repository history, release artifacts, caches, and documentation mirrors for earlier copies. 7. Enable automated secret scanning in pre-commit and continuous-integration workflows. 8. Do not treat deletion from the current revision as sufficient remediation; assume the exposed credential is compromised. ]]>