T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:74- Finding
Insufficiently Protected Fiverr Credential Storage
- Content
View full analysis
Advanced](/?t=settings&s=advanced) 3. Save password as `FIVERR_PASSWORD` 4. Save your Fiverr username as `FIVERR_USERNAME` ``` ### Technical Analysis The setup instructions direct users to save their Fiverr password in application settings without requiring a dedicated secret manager, encryption at rest, access controls, log redaction, or credential lifecycle protections. A password is a reusable authentication secret and should not be handled as ordinary configuration data. If the referenced settings interface stores values in plaintext, exposes them to other skills or processes, includes them in diagnostics, or serializes them into backups, the Fiverr account credentials could be disclosed. The supplied project does not contain implementation code demonstrating secure storage or limiting access to `FIVERR_PASSWORD`. ### Attack Path 1. A user follows the documented setup procedure and stores their Fiverr email, username, and password in the application settings. 2. The settings backend, another installed component, a diagnostic export, a log, or a user with access to the settings obtains the stored value. 3. The exposed password is used to authenticate to Fiverr as the victim. 4. Subject to Fiverr's authentication controls, the attacker may access messages, customer information, gigs, orders, and account settings. This attack path is conditional on the settings platform exposing or inadequately protecting the stored value; the project does not provide the settings implementation needed to establish that behavior directly. ### Impact Assessment Successful credential disclosure could allow unauthorized access to the associated Fiverr seller account. The potential scope includes readi ...[truncated 445 chars]- Remediation
View remediation