T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:67- Finding
Browser-Side API Key Exposure in React Integration Example
- Content
View full analysis
``` ### Technical Analysis The documented React integration passes an API key directly to a client-side provider. Although `ak_your_key` is a placeholder rather than a real embedded credential, users following this pattern would likely substitute a production key. Secrets included in browser-side applications cannot be kept confidential. The key may be recovered from the compiled JavaScript bundle, source maps, browser developer tools, runtime state, or intercepted client requests. Transport encryption does not prevent users controlling the browser from viewing credentials sent by that browser. Direct network transmission of prompts and conversation history to the declared AINative endpoint is necessary for the hosted chat-completions functionality and is clearly disclosed. The excessive privilege arises from giving every browser client possession of a reusable account credential rather than mediating requests through a trusted server. ### Attack Path 1. A developer follows the documented React example and replaces `ak_your_key` with a valid production API key. 2. The build system embeds the key into browser-accessible JavaScript or application runtime configuration. 3. An attacker visits the application and inspects its JavaScript, network requests, or component state. 4. The attacker extracts the reusable API key. 5. The attacker submits requests directly to the AINative API using the victim's credential. 6. Those requests consume the victim's credits and quotas and may continue until the key is revoked. ### Impact Assessment An attacker could obtain the same API authorization granted to the exposed key. Depending on the p ...[truncated 338 chars]- Remediation
View remediation