T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/db_query.py:547
- Finding
- Hardcoded Database Credentials Expose Sensitive Test Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-27, 80-85, 110-115, 158-163`; `scripts/db_query.py:547-553` **Vulnerability Type**: Hardcoded secret and plaintext database credentials **Risk Level**: High ### Vulnerable Code ```python conn = { "host": "10.115.96.247", "port": 3306, "user": "jxindependent", "password": "Xj2zCkLJXTkEJ5j", "database": "jxindependent0", "charset": "utf8mb4" } buyer_tax_no = "91440606MA4WHN8C8X" ``` The documentation also discloses the complete connection parameters: ```text host = 10.115.96.247 port = 3306 database = jxindependent0 user = jxindependent password = Xj2zCkLJXTkEJ5j ``` ### Technical Analysis A live-looking database password is embedded in both the executable script and the Skill documentation. The repository also supplies the corresponding host, port, username, database name, and a taxpayer identifier. Anyone who can read the package can recover everything required to attempt database authentication. Embedding credentials prevents independent secret rotation, makes accidental disclosure through source distribution or logs more likely, and gives every user of the Skill the same database identity. The database account's exact grants are not shown, so the maximum privilege available through this credential cannot be determined from the audited files. ### Attack Path 1. An attacker obtains or reads the Skill package. 2. The attacker extracts the database host, port, username, password, and database name. 3. The attacker establishes network access to `10.115.96.247:3306`, if reachable from their environment. 4. The attacker authenticates using the disclosed credentials. 5. The attacker reads invoice and taxpayer records and, if the account has write privileges, modifies or deletes database data. ### Impact Assessment Successful exploitation can expose invoice numbers, invoice codes, buyer and seller taxpayer identifiers, company names, invoice dates, statuses, and relate ...[truncated 220 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the disclosed database password. 2. Remove the password from the script, documentation, examples, version history, release artifacts, and caches. 3. Load credentials at runtime from an approved secret manager or protected environment variables. 4. Use a dedicated read-only database principal limited to the required schemas, tables, columns, and source networks. 5. Avoid including real taxpayer identifiers or production-like records in documentation. 6. Add automated secret scanning to development and release pipelines. 7. Audit database authentication and query logs for previous unauthorized use of the disclosed credential. ]]>