T09 · Insecure Skill Coding Practices
Error
- Location
scripts/broadcast_sign_transfer.py:237- Finding
Sensitive API authorization and signed transaction material exposed through debug logging
- Content
View full analysis
dict: timestamp = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] + "Z" sign = self._okx_sign(timestamp, method, path, body) print(f" [DEBUG] timestamp: {timestamp}") print(f" [DEBUG] method: {method}") print(f" [DEBUG] path: {path}") print(f" [DEBUG] body: {body}") print(f" [DEBUG] sign: {sign}") return { "OK-ACCESS-KEY": str(self.api_key), "OK-ACCESS-SIGN": str(sign), "OK-ACCESS-PASSPHRASE": str(self.passphrase), "OK-ACCESS-TIMESTAMP": str(timestamp), "Content-Type": "application/json", } ``` The signed transactions are also printed by both transfer operations: ```python signed_tx = self._sign_native_tx(to_address, amount_wei) print(f" signed_tx: {signed_tx}") return self._broadcast(signed_tx, enable_mev_protection) ``` ```python signed_tx = self._sign_token_tx(token_address, to_address, amount_raw) print(f" signed_tx: {signed_tx}") return self._broadcast(signed_tx, enable_mev_protection) ``` ### Technical Analysis The Skill writes the complete OKX request body, timestamp, request path, request method, HMAC authorization signature, and raw signed transaction to standard output. The Base64 operation used to produce the OKX signature is ordinary encoding of an HMAC-SHA256 digest and is not, by itself, a covert exfiltration mechanism. The security problem is that the encoded signature and every input needed to reproduce the authenticated request are printed together. The request body includes the wallet address and signed transaction. The raw signed transaction does not expose the wallet private key and cannot be modified ...[truncated 1672 chars]- Remediation
View remediation