T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:11
- Finding
- Insecure Handling and Exposure of High-Privilege API Secrets## Vulnerability Details **File Location**: `SKILL.md`, lines 11–32 and 489–501 **Vulnerability Type**: Sensitive credential exposure through ordinary Agent input, session storage, command-line arguments, and response output **Risk Level**: Medium ### Vulnerable Code Snippets ```markdown ## Credential Collection Before performing any API action, Clawbot **must** collect the user's API credentials if they have not already been provided. Clawbot should prompt the user with two separate open-ended text input fields: 1. **AIOZ Stream Public Key** — Ask: *"Please enter your AIOZ Stream Public Key:"* 2. **AIOZ Stream Secret Key** — Ask: *"Please enter your AIOZ Stream Secret Key:"* Rules: - Use **open-ended text input** (not dropdowns or multiple choice) so the user can type or paste their actual key values. - Do **not** proceed with any API call until both keys have been provided. - Store them in session as `$AIOZ_PUBLIC_KEY` and `$AIOZ_SECRET_KEY` for use in all subsequent requests. - Remind the user: *"Keep your keys safe — treat them like passwords and consider rotating them after this session."* ``` ```bash AIOZ_HEADERS=( -H "stream-public-key: ${AIOZ_PUBLIC_KEY}" -H "stream-secret-key: ${AIOZ_SECRET_KEY}" ) ``` ```bash curl -s -X POST "https://api.aiozstream.network/api/api_keys" \ "${AIOZ_HEADERS[@]}" \ -H "Content-Type: application/json" \ -d '{ "api_key_name": "my key", "ttl": "100000000", "type": "full_access" }' # type: "full_access" or "only_upload" # ttl: seconds, max 2147483647 ``` ```markdown > ⚠️ **The `secret` is shown only once. Clawbot must immediately display it to the user and explicitly warn them it cannot be retrieved again.** ``` ### Technical Analysis The Skill legitimately requires AIOZ credentials to perform its declared API-management functions, and the credentials are sent only to the declared AIOZ API endpoint. No unrelated exfiltration destination was identified. However, its credential-handling procedure ...[truncated 2982 chars]
- Remediation
- ## Remediation Suggestions 1. Replace ordinary open-ended credential prompts with a masked secret-input mechanism that prevents inclusion in conversation transcripts. 2. Store credentials in a dedicated ephemeral secret store rather than general session or conversational state. 3. Scope stored credentials to the current Skill invocation and erase them immediately after completion or session termination. 4. Ensure secrets are excluded from logs, traces, telemetry, debugging output, exception messages, and command previews. 5. Avoid placing credentials directly in visible command-line arguments. Use an execution interface that supports protected secret injection or appropriately permissioned temporary configuration input, with guaranteed cleanup. 6. Redact authentication headers from all tool output and error reporting. 7. Present a newly generated secret through a dedicated one-time secret-display component rather than ordinary chat output. If that is unavailable, clearly obtain user approval before displaying it and prevent transcript retention where supported. 8. Default newly created keys to `only_upload`, the shortest practical TTL, and the minimum permissions needed for the requested operation. 9. Require explicit user confirmation before creating a `full_access` key or selecting a long TTL, and explain the resulting access scope. 10. Add documented key revocation and rotation procedures, including immediate rotation after suspected transcript or log exposure. 11. Require explicit confirmation immediately before destructive operations such as deleting media, API keys, webhooks, player themes, or playlists. 12. Preserve HTTPS-only communication and restrict authenticated requests to the declared AIOZ API origin.