T09 · Insecure Skill Coding Practices
- Location
SKILL.md:199- Finding
Plaintext API Key Storage Without Permission Hardening
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 199–202
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: MediumVulnerable Code
bash # Configure API Key export CELLCOG_API_KEY="your-api-key-here" # ... # Or write it to a configuration file echo '{"api_key": "your-api-key"}' > ~/.cellcog/config.jsonThe plaintext configuration format is also demonstrated at lines 237–244:
json // ~/.cellcog/config.json { "api_key": "your-api-key", "default_style": "pop", "default_duration": 30, "default_format": "mp3", "default_quality": "standard" }Technical Analysis
The documented setup permits a CellCog API key to be written unencrypted to a predictable file,
~/.cellcog/config.json. The instructions do not require restrictive directory or file permissions and do not recommend an operating-system credential store.Consequently, the file's effective access controls depend on the user's environment, current
umask, and any pre-existing directory permissions. The shell redirection operator also overwrites an existing configuration file without warning. Although the example contains a placeholder, users are instructed to configure an actual API key using this mechanism.Attack Path
- A user follows the setup instructions and replaces the placeholder with a valid CellCog API key.
- The shell writes that credential in plaintext to
~/.cellcog/config.json. - The file is created with permissions derived from the current environment, without explicit access restrictions.
- Another local user, process, compromised backup, or accidentally exposed archive obtains the configuration file.
- The attacker extracts the key and submits authenticated requests to the CellCog API.
This exploitation path requires access to the configuration file through permissive local permissions, another compromised process operating in the user's context, or disclosure through backups or archives.
Impact Ass
...[truncated 618 chars]
- Remediation
View remediation
Remediation Suggestions
Prefer injecting the API key through a protected environment at runtime or storing it in an operating-system credential manager rather than a plaintext configuration file.
If file-based storage is necessary:
- Create the configuration directory with mode
0700. - Set a restrictive
umaskbefore creating the file. - Set the configuration file mode to
0600. - Avoid silently overwriting existing configuration.
- Ensure the file is excluded from source control, diagnostic bundles, logs, and unencrypted backups.
- Never print the real API key in command output.
- Document key rotation and immediate revocation procedures.
A hardened file-creation example is:
bash install -d -m 700 ~/.cellcog umask 077 printf '%s\n' '{"api_key":"REPLACE_SECURELY"}' > ~/.cellcog/config.json chmod 600 ~/.cellcog/config.jsonFor stronger protection, replace file-based storage with the platform keychain or a dedicated secret-management service.
- Create the configuration directory with mode