T09 · Insecure Skill Coding Practices
- Location
SKILL.md:179- Finding
Sensitive Environment Variable Enumeration May Expose Credentials
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 179–181
Vulnerability Type: Sensitive environment reconnaissance and plaintext credential exposure
Risk Level: MediumComplete Code Snippet:
bash env | grep -E "API|KEY|TOKEN|SECRET" | sed "s/=.*/=***/" # Linux/macOS # Or PowerShell # Get-ChildItem Env: | Where-Object {$_.Name -match "API|KEY|TOKEN"} | Format-TableTechnical Analysis
The configuration-validation instructions search the entire process environment for variable names associated with API keys, tokens, and secrets rather than checking only the specific calendar credential required by the selected provider.
The Linux/macOS command masks values before displaying them, but still discloses credential names and their presence. The PowerShell alternative passes matching environment-variable objects directly to
Format-Table, which may display both names and plaintext values. If an AI Agent executes this instruction, credential information can enter terminal output, Agent transcripts, diagnostic logs, or other retained execution records.This violates least-privilege and sensitive-data-handling principles. Calendar configuration validation does not require enumerating unrelated credentials from the entire environment.
Attack Path
- A user asks the Agent to configure or validate the calendar Skill.
- The Agent follows the validation instructions in
SKILL.md. - The command enumerates all environment variables whose names contain credential-related terms.
- On PowerShell, matching secret values may be printed in plaintext; on Linux/macOS, credential names and availability are disclosed.
- The resulting data may be retained in terminal history, Agent conversation history, execution logs, or monitoring systems.
- Any party able to access those records may recover the disclosed values or use the credential metadata to guide further attacks.
No instruction that trans ...[truncated 690 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove broad searches for names matching
API,KEY,TOKEN, orSECRET. -
Validate only the exact variable required by the configured calendar provider.
-
Report only whether the variable is set; never print its value.
-
Use provider-specific checks such as:
bash if [ -n "${GOOGLE_CALENDAR_API_KEY:-}" ]; then echo "Google Calendar credential is configured" else echo "Google Calendar credential is not configured" fipowershell if (Test-Path Env:GOOGLE_CALENDAR_API_KEY) { Write-Output "Google Calendar credential is configured" } else { Write-Output "Google Calendar credential is not configured" } -
Avoid enabling shell tracing while credentials are processed.
-
Prevent command output containing sensitive configuration data from being written to persistent Agent logs.
-
Document the precise credential names required by each supported provider and apply least-privilege scopes to those credentials.
-