T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:83
- Finding
- API Key Disclosed by Configuration Status Command## Vulnerability Details **File Location**: `SKILL.md:83-85` **Vulnerability Type**: Credential exposure through unsafe shell parameter expansion **Risk Level**: High **Vulnerable Code:** ```bash # Check if key is configured echo "Key: ${SPARKI_API_KEY:+configured}${SPARKI_API_KEY:-MISSING}" ``` ### Technical Analysis The command is presented as a status check, but it prints the actual API key whenever `SPARKI_API_KEY` is set. The first expansion, `${SPARKI_API_KEY:+configured}`, produces the word `configured`, while the second expansion, `${SPARKI_API_KEY:-MISSING}`, produces the secret value. These results are concatenated. For example, if the environment contains `SPARKI_API_KEY=sk_live_secret`, the command prints: ```text Key: configuredsk_live_secret ``` This exposes a credential in standard output rather than merely reporting whether it is configured. ### Attack Path 1. A user configures `SPARKI_API_KEY` as instructed by the skill. 2. The prerequisite status command is executed. 3. The shell expands the environment variable to its complete secret value. 4. The secret is written to terminal output. 5. The credential may be captured by an agent transcript, shell log, CI log, terminal recording, monitoring system, or another party with access to command output. 6. An attacker who obtains the key may submit authenticated requests to the associated service, subject to the permissions assigned to that key. ### Impact Assessment The vulnerability directly compromises the confidentiality of `SPARKI_API_KEY`. An attacker could obtain the same service-level privileges granted to the exposed key, potentially including media uploads, project creation, project-status access, and consumption of account resources. The precise scope depends on server-side permissions and account controls. This issue does not by itself grant local operating-system privileges.
- Remediation
- ## Remediation Suggestions Replace the unsafe expansion with a status-only conditional that never interpolates the credential into output: ```bash if [[ -n "${SPARKI_API_KEY:-}" ]]; then echo "Key: configured" else echo "Key: MISSING" fi ``` Additional hardening measures: - Never print, trace, or log API keys, including during diagnostic operations. - Disable shell tracing before handling credentials and ensure callers do not invoke the workflow with `set -x`. - Redact authorization headers and environment variables from agent transcripts and CI logs. - Rotate any credential that may already have been exposed by this command. - Restrict API keys to the minimum required permissions and apply expiration, quotas, and server-side audit logging.