T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:11- Finding
Insecure Handling and Exposure of High-Privilege API Secrets
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 11–32 and 489–501
Vulnerability Type: Sensitive credential exposure through ordinary Agent input, session storage, command-line arguments, and response output
Risk Level: MediumVulnerable Code Snippets
markdown ## Credential Collection Before performing any API action, Clawbot **must** collect the user's API credentials if they have not already been provided. Clawbot should prompt the user with two separate open-ended text input fields: 1. **AIOZ Stream Public Key** — Ask: *"Please enter your AIOZ Stream Public Key:"* 2. **AIOZ Stream Secret Key** — Ask: *"Please enter your AIOZ Stream Secret Key:"* Rules: - Use **open-ended text input** (not dropdowns or multiple choice) so the user can type or paste their actual key values. - Do **not** proceed with any API call until both keys have been provided. - Store them in session as `$AIOZ_PUBLIC_KEY` and `$AIOZ_SECRET_KEY` for use in all subsequent requests. - Remind the user: *"Keep your keys safe — treat them like passwords and consider rotating them after this session."*bash AIOZ_HEADERS=( -H "stream-public-key: ${AIOZ_PUBLIC_KEY}" -H "stream-secret-key: ${AIOZ_SECRET_KEY}" )bash curl -s -X POST "https://api.aiozstream.network/api/api_keys" \ "${AIOZ_HEADERS[@]}" \ -H "Content-Type: application/json" \ -d '{ "api_key_name": "my key", "ttl": "100000000", "type": "full_access" }' # type: "full_access" or "only_upload" # ttl: seconds, max 2147483647markdown > ⚠️ **The `secret` is shown only once. Clawbot must immediately display it to the user and explicitly warn them it cannot be retrieved again.**Technical Analysis
The Skill legitimately requires AIOZ credentials to perform its declared API-management functions, and the credentials are sent only to the declared AIOZ API endpoint. No unrelated exfiltration destination was identified. However, its credential-handling procedure ...[truncated 2982 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace ordinary open-ended credential prompts with a masked secret-input mechanism that prevents inclusion in conversation transcripts.
- Store credentials in a dedicated ephemeral secret store rather than general session or conversational state.
- Scope stored credentials to the current Skill invocation and erase them immediately after completion or session termination.
- Ensure secrets are excluded from logs, traces, telemetry, debugging output, exception messages, and command previews.
- Avoid placing credentials directly in visible command-line arguments. Use an execution interface that supports protected secret injection or appropriately permissioned temporary configuration input, with guaranteed cleanup.
- Redact authentication headers from all tool output and error reporting.
- Present a newly generated secret through a dedicated one-time secret-display component rather than ordinary chat output. If that is unavailable, clearly obtain user approval before displaying it and prevent transcript retention where supported.
- Default newly created keys to
only_upload, the shortest practical TTL, and the minimum permissions needed for the requested operation. - Require explicit user confirmation before creating a
full_accesskey or selecting a long TTL, and explain the resulting access scope. - Add documented key revocation and rotation procedures, including immediate rotation after suspected transcript or log exposure.
- Require explicit confirmation immediately before destructive operations such as deleting media, API keys, webhooks, player themes, or playlists.
- Preserve HTTPS-only communication and restrict authenticated requests to the declared AIOZ API origin.