T09 · Insecure Skill Coding Practices
- Location
SKILL.md:604- Finding
API Key Exposure Through Troubleshooting Command
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 604–609
Vulnerability Type: Plaintext secret disclosure
Risk Level: MediumVulnerable code:
bash # Troubleshooting: API Key Issues # 1. Check that the MATON_API_KEY environment variable is set: echo $MATON_API_KEYTechnical Analysis
The troubleshooting instructions disclose the complete
MATON_API_KEYin plaintext instead of checking only whether the variable is present. Terminal output may be retained in CI logs, shell recordings, support transcripts, screenshots, screen-sharing sessions, or copied diagnostic output.The key authenticates requests to Maton's gateway and connection-management APIs. Although it does not independently grant access to an unconnected third-party service, exposure may allow an attacker to exercise the third-party connections already authorized under the affected Maton account.
Attack Path
- A user experiences an authentication problem and follows the documented troubleshooting procedure.
- The user runs
echo $MATON_API_KEY. - The complete key is written to a terminal or retained log.
- An attacker obtains the output through log access, screen sharing, screenshots, terminal history capture, or copied support diagnostics.
- The attacker supplies the stolen key as
Authorization: Bearer ...togateway.maton.aiorctrl.maton.ai. - Subject to the key's effective account permissions and active OAuth connections, the attacker accesses or modifies connected third-party resources.
Impact Assessment
Successful exploitation may permit unauthorized inspection of connection metadata and use of active third-party connections. Depending on the OAuth scopes and connected services, this could expose business records, messages, documents, contacts, CRM data, or financial information, and could permit write or delete operations.
The compromise scope is bounded by the permissions associated with ...[truncated 155 chars]
- Remediation
View remediation
Remediation Suggestions
Replace plaintext key output with a presence-only check:
bash if [ -n "${MATON_API_KEY:-}" ]; then echo "MATON_API_KEY is set" else echo "MATON_API_KEY is not set" fiAdditional hardening measures:
- Never print, log, partially echo, or include the API key in support diagnostics.
- Add explicit documentation warning users not to paste keys into tickets, chat sessions, screenshots, or command output.
- Redact authorization headers in gateway, client, and debugging logs.
- Provide a safe authenticated health-check command that reports only success or failure.
- Support short-lived or narrowly scoped credentials where feasible.
- Rotate the API key immediately if it has appeared in retained logs or shared diagnostics.
- Review active OAuth connections and audit gateway activity following suspected exposure.