T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:171- Finding
Unnecessary Enumeration of Credential-Related Environment Variables
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 171-173
Vulnerability Type: Credential-related environment reconnaissance beyond the Skill's legitimate image-processing requirements
Risk Level: Mediumbash env | grep -E "API|KEY|TOKEN|SECRET" | sed "s/=.*/=***/" # Linux/macOS # 或 PowerShell # Get-ChildItem Env: | Where-Object {$_.Name -match "API|KEY|TOKEN"} | Format-TableTechnical Analysis
The Skill instructs the Agent to enumerate environment variables whose names contain credential-related terms such as
API,KEY,TOKEN, andSECRET. This operation is unrelated to the declared local image-processing functionality and violates the principle of least privilege.The Unix command masks values before displaying its final output, but it still reads the environment and reveals the names and presence of secret-bearing variables. The suggested PowerShell command is more dangerous because
Get-ChildItem Env:produces environment-variable objects containing names and values; formatting matching objects as a table may disclose credential values directly in terminal output, Agent responses, or execution logs.No outbound transmission mechanism was identified, so direct credential exfiltration is not established. Nevertheless, exposing sensitive environment data to an Agent session or its logs creates an unauthorized-access risk.
Attack Path
- A user or Agent loads the Skill and follows its environment verification instructions.
- The Agent executes the credential-enumeration command using its authorized
execcapability. - The command searches the Agent process environment for variables associated with API keys, tokens, or secrets.
- On Unix-like systems, credential-bearing variable names are exposed even though displayed values are masked.
- On PowerShell, matching environment-variable objects may display both names and values.
- Sensitive information becomes available throu ...[truncated 965 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove both commands that enumerate broadly named credential-related environment variables.
- Do not inspect every environment variable to verify configuration. Check only a specifically documented variable that is strictly required by the Skill.
- Return only a boolean or generic status message indicating whether the required variable exists; never print its value.
- Because the documented image-processing commands do not require an API credential, remove the credential verification step entirely unless a concrete dependency is introduced.
- If future functionality requires a secret, use platform secret stores or narrowly scoped environment access and redact sensitive values before they enter Agent output, logs, diagnostics, or error messages.
- Add an explicit instruction prohibiting the Agent from listing, logging, or returning environment variables containing credentials.
- Test Unix and PowerShell verification procedures to ensure neither variable names nor values are disclosed unnecessarily.