T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:232
- Finding
- Plaintext Storage of Binance API Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 232–239, 278–296, and 309–315 **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: High ### Vulnerable Code Snippets ```markdown Users can provide Binance API credentials by sending a file where the content is in the following format: ```bash abc123...xyz secret123...key ``` ``` ```markdown ### TOOLS.md Structure ```bash ## Binance Accounts ### main - API Key: abc123...xyz - Secret: secret123...key - Testnet: false - Description: Primary trading account ### testnet-dev - API Key: test456...abc - Secret: testsecret...xyz - Testnet: true - Description: Development/testing ### futures-keys - API Key: futures789...def - Secret: futuressecret...uvw - Testnet: false - Description: Futures trading account ``` ``` ```markdown ## Adding New Accounts When user provides new credentials: * Ask for account name * Ask: Mainnet, Testnet or Demo * Store in `TOOLS.md` with masked display confirmation ``` ### Technical Analysis The skill instructs users to submit raw Binance API credentials and directs the agent to persist those credentials in a Markdown file named `TOOLS.md`. Although the displayed confirmation is masked, the underlying stored values remain plaintext. Display masking therefore provides no protection against filesystem access. Any process, tool, agent session, backup system, repository operation, or user with access to the workspace could read and recover the credentials. Markdown files are also likely to be copied, indexed, included in diagnostic output, or accidentally committed to version control. The credentials are intended to sign authenticated Binance requests. Consequently, disclosure of the secret key enables an attacker to generate valid signatures and exercise every capability granted to that API key. ### Attack Path 1. A user supplies a Binance API key and secret to the skill. 2. Following the documented instructions, the agent writes both values ...[truncated 1098 chars]
- Remediation
- ## Remediation Suggestions 1. Do not store API keys, secret keys, or private signing keys in `TOOLS.md`, other Markdown files, source files, logs, or ordinary workspace configuration. 2. Integrate with an operating-system keychain, hardware-backed credential store, or dedicated secret-management service. 3. Store only a non-sensitive account identifier in skill configuration and resolve the corresponding credential from the secure store at request time. 4. Keep secret values in memory only for the minimum period required to sign a request, and clear temporary buffers where supported. 5. If temporary file storage is unavoidable, use a file outside the repository with owner-only permissions, encryption at rest, restrictive lifecycle controls, and guaranteed deletion. 6. Add secret-bearing files to version-control ignore rules and deploy secret-scanning controls in local and CI workflows. 7. Never include credentials in prompts, command output, error messages, telemetry, or logs. Display masking must be treated only as an additional presentation safeguard, not as storage protection. 8. Recommend and validate least-privilege Binance keys where feasible: enable only required trading permissions, disable withdrawals, configure IP allowlists, use separate credentials per environment, and prefer testnet credentials during development. 9. Rotate any credentials that were previously stored according to the documented plaintext format.