T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:13- Finding
Hard-Coded WizNote Credentials and Private Infrastructure Details
- Content
View full analysis
WIZ_KB_GUID=c6522160-aca4-11ef-97d7-3bf3be62286f WIZ_USER_ID=843909253@qq.com WIZ_PASSWORD=i1ove1314W. ``` ### Technical Analysis The Skill documentation contains a concrete email address, password, knowledge-base GUID, and private network endpoint. Although the token is a placeholder, the remaining values appear to be operational credentials rather than neutral examples. Documentation distributed with a Skill is part of the delivered package. Anyone with access to the package can recover these values without needing to inspect runtime memory or environment variables. The exposed knowledge-base GUID and endpoint also reveal details about the private deployment. This disclosure is not required for the declared WizNote connector functionality. Placeholder values would provide the same configuration guidance without granting access to a specific account. ### Attack Path 1. An attacker downloads or otherwise obtains the Skill package. 2. The attacker reads `SKILL.md`. 3. The attacker extracts the WizNote account, password, endpoint, and knowledge-base GUID. 4. If the endpoint is reachable directly, through the same local network, or through another compromised system, the attacker attempts to authenticate using the exposed credentials. 5. Successful authentication may permit reading, creating, changing, sharing, or deleting notes according to the account's permissions. ### Impact Assessment Successful exploitation may expose all notes, attachments, comments, tags, categories, and sharing information available to the affected account. Because the connector supports destructive operations, the exposed account could also be used to modify or delete data. The private endpoint and account identifier remain s ...[truncated 123 chars]- Remediation
View remediation
WIZ_PASSWORD= WIZ_KB_GUID= ``` 5. Store production secrets in environment variables or a dedicated secret manager. 6. Add automated secret scanning to the development and release process. 7. Use a dedicated least-privilege WizNote account rather than a personal or administrator account. ]]>