T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:267
- Finding
- Generated Ed25519 Private Key Disclosed Through Standard Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 267–269; repeated at lines 695–698 **Vulnerability Type**: Private key exposure through application logs **Risk Level**: High ### Vulnerable Code ```typescript console.log('Orderly Key:', orderlyKey); console.log('Private Key (hex):', bytesToHex(privateKey)); // STORE PRIVATE KEY SECURELY - NEVER SHARE IT ``` The same insecure pattern appears again later: ```typescript console.log('Private Key (hex):', bytesToHex(privateKey)); console.log('Public Key (base58):', orderlyKey); // STORE PRIVATE KEY SECURELY - NEVER SHARE IT ``` ### Technical Analysis The example converts a newly generated Ed25519 private key into hexadecimal and prints the complete value to standard output. The warning to store the key securely does not mitigate the disclosure performed by the preceding executable statement. Standard output is frequently captured by agent runtimes, CI/CD systems, container logging drivers, hosted notebooks, terminal history collectors, or centralized logging platforms. In an agent environment, output may also be returned directly to the invoking user or service. The private key is the credential used to create valid Orderly API signatures. Unlike the public Orderly key and protocol signatures, disclosure of the private key is not required for the declared authentication functionality. ### Attack Path 1. A user copies and executes the documented key-generation example. 2. The code generates a valid Ed25519 private key and registers or prepares it for registration with an Orderly account. 3. The example converts the private key to hexadecimal and writes it to standard output. 4. An attacker obtains access to captured console output, agent execution results, CI logs, shared terminal records, or centralized logging infrastructure. 5. The attacker imports the exposed key and derives its associated public Orderly key. 6. If the key has been registered and remains valid, the attacker gene ...[truncated 670 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove every statement that prints, serializes, or otherwise exposes private key material: ```typescript console.log('Orderly Key:', orderlyKey); // Never print privateKey or bytesToHex(privateKey). ``` - Send generated keys directly to a protected secret-management workflow rather than passing them through standard output. - Use a managed secret store such as HashiCorp Vault, AWS Secrets Manager, or an equivalent platform with encryption, access control, and audit logging. - If local storage is unavoidable, create the file with owner-only permissions and encrypt the key at rest. - Configure logging systems to redact credential-like hexadecimal values and prevent debug logs from reaching untrusted users. - Add automated secret-scanning or linting rules that reject logging calls containing private keys, seeds, mnemonic phrases, or signing credentials. - Revoke and rotate any key that may already have been exposed through execution of these examples. ]]>