T09 · Insecure Skill Coding Practices
- Location
SKILL.md:165- Finding
Credential Disclosure Through Broad Environment Variable Enumeration
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:165-167
Vulnerability Type: Sensitive information exposure
Risk Level: HighComplete Code Snippet
bash env | grep -E "API|KEY|TOKEN|SECRET" | sed "s/=.*/=***/" # Linux/macOS # or PowerShell # Get-ChildItem Env: | Where-Object {$_.Name -match "API|KEY|TOKEN"} | Format-TableTechnical Analysis
The configuration-validation procedure broadly enumerates environment variables whose names contain
API,KEY,TOKEN, orSECRET, rather than checking only the specific variable required by the skill.On Linux and macOS, the
sedexpression masks values before displaying the results, but it still exposes sensitive variable names. These names may reveal deployed services, authentication mechanisms, infrastructure details, or credential naming conventions.The documented PowerShell alternative is more severe:
Get-ChildItem Env:produces environment-variable objects containing names and values, andFormat-Tabledisplays both by default. Consequently, matching API keys and access tokens can be printed in plaintext to the Agent response, console, transcript, or execution logs.No evidence indicates that the skill transmits these credentials to an external destination. The confirmed issue is local disclosure through command output.
Attack Path
- A user asks the Agent to validate the skill configuration according to
SKILL.md. - The Agent uses its permitted
execcapability to execute the documented operating-system-specific command. - The command searches the entire process environment for broadly named credential variables, including credentials unrelated to this skill.
- On PowerShell, matching variable names and plaintext values are formatted into command output.
- The Agent, terminal, or surrounding platform records or displays that output.
- A party with access to the conversation transcript, terminal output, or execution l ...[truncated 888 chars]
- A user asks the Agent to validate the skill configuration according to
- Remediation
View remediation
Remediation Suggestions
- Remove broad environment enumeration based on generic patterns such as
API|KEY|TOKEN|SECRET. - Define the exact environment variable required by the skill and check only whether that variable exists.
- Return only a boolean status such as
configuredormissing; never print the variable's value. - Ensure validation output is safe on every supported platform rather than relying on platform-specific default formatting.
- Avoid exposing credential names unless they are explicitly documented and necessary for remediation.
- Add instructions prohibiting the Agent from including environment-variable values in responses, logs, exceptions, or diagnostic output.
- If a credential may already have been exposed through the PowerShell command, revoke and rotate it, then review Agent transcripts and execution logs for unauthorized disclosure.
Safer examples:
bash if [ -n "${DASHBOARD_API_KEY:-}" ]; then printf '%s\n' 'DASHBOARD_API_KEY is configured' else printf '%s\n' 'DASHBOARD_API_KEY is missing' fipowershell if (Test-Path Env:DASHBOARD_API_KEY) { Write-Output "DASHBOARD_API_KEY is configured" } else { Write-Output "DASHBOARD_API_KEY is missing" }- Remove broad environment enumeration based on generic patterns such as