T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:26- Finding
API Credential Exposed Through Public Client-Side Configuration
- Content
View full analysis
import { provideAINative } from '@ainative/vue-sdk'; provideAINative({ apiKey: import.meta.env.VITE_AINATIVE_API_KEY }); ``` ```typescript // plugins/ainative.client.ts import { provideAINative } from '@ainative/vue-sdk'; export default defineNuxtPlugin(() => { provideAINative({ apiKey: useRuntimeConfig().public.ainativeApiKey }); }); ``` ```typescript // nuxt.config.ts export default defineNuxtConfig({ runtimeConfig: { public: { ainativeApiKey: process.env.VITE_AINATIVE_API_KEY } } }); ``` ### Technical Analysis The Skill instructs users to place a value identified as an `apiKey` in two explicitly public frontend configuration mechanisms: - Vite environment variables prefixed with `VITE_` are substituted into client-side application code and can be recovered from the generated JavaScript bundle or observed during browser requests. - Nuxt values under `runtimeConfig.public` are intentionally exposed to client-side code. Consequently, these mechanisms do not protect secret API credentials. The documentation does not state that this key is a restricted publishable token, nor does it require short expiration, origin restrictions, narrow scopes, or per-user authorization. Although transmitting authentication information and chat messages to the declared AINative API is consistent with the Skill's hosted-chat functionality, exposing a reusable secret to every browser exceeds minimum-privilege requirements. A secret credential does not need to be distributed to untrusted clients when requests can instead be brokered through an authenticated backend. ### Attack Path ...[truncated 1358 chars]- Remediation
View remediation