T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:74
- Finding
- Insufficiently Protected Fiverr Credential Storage< 3. Save password as `FIVERR_PASSWORD` 4. Save your Fiverr username as `FIVERR_USERNAME` ``` ### Technical Analysis The setup instructions direct users to save their Fiverr password in application settings without requiring a dedicated secret manager, encryption at rest, access controls, log redaction, or credential lifecycle protections. A password is a reusable authentication secret and should not be handled as ordinary configuration data. If the referenced settings interface stores values in plaintext, exposes them to other skills or processes, includes them in diagnostics, or serializes them into backups, the Fiverr account credentials could be disclosed. The supplied project does not contain implementation code demonstrating secure storage or limiting access to `FIVERR_PASSWORD`. ### Attack Path 1. A user follows the documented setup procedure and stores their Fiverr email, username, and password in the application settings. 2. The settings backend, another installed component, a diagnostic export, a log, or a user with access to the settings obtains the stored value. 3. The exposed password is used to authenticate to Fiverr as the victim. 4. Subject to Fiverr's authentication controls, the attacker may access messages, customer information, gigs, orders, and account settings. This attack path is conditional on the settings platform exposing or inadequately protecting the stored value; the project does not provide the settings implementation needed to establish that behavior directly. ### Impact Assessment Successful credential disclosure could allow unauthorized access to the associated Fiverr seller account. The potential scope includes readi ...[truncated 445 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Store `FIVERR_PASSWORD` only in a dedicated secret-management facility or operating-system credential store, never in ordinary settings or committed configuration files. 2. Document whether the referenced settings interface encrypts secrets at rest and restricts secret retrieval to the specific skill that requires them. 3. Ensure secret values are masked in the user interface and excluded from logs, telemetry, crash reports, backups, command output, and diagnostic exports. 4. Apply least-privilege access controls so unrelated skills, plugins, users, and processes cannot read the credential. 5. Prefer short-lived session credentials or an officially supported delegated authorization mechanism instead of retaining a reusable account password, where Fiverr supports such an option. 6. Require multifactor authentication on the Fiverr account and notify users that browser-automation sessions must be protected against cookie and profile theft. 7. Provide credential rotation and revocation procedures, including immediate password rotation if settings, logs, or backups may have exposed the secret. 8. Add implementation and tests that verify secret redaction, encrypted storage, restricted retrieval, and safe deletion. ]]>