T09 · Insecure Skill Coding Practices
- Location
SKILL.md:163- Finding
Broad Environment Inspection May Expose API Keys and Tokens
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 163–169
Vulnerability Type: Credential exposure through unnecessary environment-variable enumeration
Risk Level: MediumVulnerable Code
bash # Verify whether environment variables are configured echo "Configuration check:" env | grep -E "API|KEY|TOKEN|SECRET" | sed "s/=.*/=***/" # Linux/macOS # Or PowerShell # Get-ChildItem Env: | Where-Object {$_.Name -match "API|KEY|TOKEN"} | Format-TableTechnical Analysis
The Skill recommends enumerating all environment variables whose names contain credential-related terms. This inspection is broader than necessary for meeting-note processing and violates the principle of minimizing access to sensitive runtime information.
The Linux/macOS command reads all environment variables before filtering them. Although
sedmasks the displayed values, it still reveals the existence and names of credential-bearing variables in terminal output, Agent transcripts, and logs.The PowerShell alternative is more severe:
Get-ChildItem Env:produces objects containing both variable names and values, andFormat-Tablemay render matching API keys or tokens in plaintext. If an AI Agent executes this validation instruction, the resulting output can be incorporated into its conversation context or retained by terminal and platform logging systems.No evidence indicates that the Skill transmits these credentials to an external destination. The confirmed risk is local disclosure through output and logging rather than demonstrated exfiltration.
Attack Path
- A user loads the Skill and follows its environment-validation instructions.
- The AI Agent invokes the provided Unix or PowerShell command through its declared execution capability.
- The command enumerates the process environment and selects variables with names containing
API,KEY,TOKEN, orSECRET. - On Unix-like systems, sensitive varia ...[truncated 1161 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove broad enumeration of environment variables based on generic credential-related keywords.
-
Define the exact environment variable required by the Skill, if any, and validate only whether that specific variable is present.
-
Never print a secret value. Return only a boolean or fixed status message, such as
API credential is configured. -
Avoid piping complete environment listings through filtering commands because the full environment is still accessed by the pipeline.
-
Replace the PowerShell example with an explicit presence check that cannot render the value:
powershell if (Test-Path Env:REQUIRED_API_KEY) { Write-Output "Required API credential is configured." } else { Write-Output "Required API credential is not configured." } -
Use an equivalent value-free check on Unix-like systems:
bash if [ -n "${REQUIRED_API_KEY+x}" ]; then echo "Required API credential is configured." else echo "Required API credential is not configured." fi -
If meeting-note processing does not require an external credential, remove the credential-validation section entirely.
-
Configure the Agent and execution environment to redact secrets from command output and avoid retaining sensitive terminal output in persistent logs.
-