T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send-email.py:18- Finding
Hardcoded SMTP Credentials Exposed in Source Code
- Content
View full analysis
" ``` The exposed values are subsequently used to authenticate: ```python with smtplib.SMTP_SSL(SMTP_HOST, SMTP_PORT, context=context) as server: server.login(SMTP_USER, SMTP_PASS) server.sendmail(SMTP_FROM, to_email, msg.as_string()) ``` ### Technical Analysis The sender contains a plaintext, live-looking SMTP username and password. Any person who can access the package or its source can recover these values without executing the Skill. This contradicts the documentation, which directs users to supply SMTP credentials through an environment configuration file. Embedding credentials in distributed source code prevents safe per-deployment secret management and causes the same account to be shared across all copies of the package. Removing the credential from the current file alone is insufficient if it has already been committed or published, because it may remain available through package archives or repository history. ### Attack Path 1. An attacker downloads or otherwise obtains the Skill package. 2. The attacker opens `scripts/send-email.py` and extracts `SMTP_USER` and `SMTP_PASS`. 3. The attacker attempts authentication against `smtp.163.com` on port 465. 4. If the credential remains valid, the attacker uses the mailbox to send unsolicited, fraudulent, or phishing messages. 5. Messages may appear to originate from the embedded account, damaging its reputation and potentially causing service suspension or blocklisting. ### Impact Assessment Successful exploitation may provide authenticated access to the configured SMTP account. The attacker could send messages as the exposed identity, consu ...[truncated 343 chars]- Remediation
View remediation