T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:39
- Finding
- Persistent Storage of Non-Expiring Bearer Tokens<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:39-41` and `SKILL.md:312` **Vulnerability Type**: Insecure credential storage guidance **Risk Level**: High ### Vulnerable Code ```markdown - **Token format:** `aud_live_xxxx` (48 hex chars after prefix) - **Auth tokens never expire** — store persistently by email - **Session tokens** expire in 30 min (only needed during OTP flow) ``` The recommendation is repeated later: ```markdown - **Store authTokens** persistently by email — returning users skip OTP entirely ``` ### Technical Analysis The Skill explicitly instructs agents to retain bearer credentials indefinitely and associate them with users' email addresses. It does not require encryption, an operating-system-backed secret manager, access controls, credential rotation, revocation, or automatic deletion. A bearer token grants access based solely on possession. Because the documented tokens never expire, disclosure from agent memory, local state, backups, diagnostic output, or another storage mechanism could permit continuing access until the server explicitly revokes the token. Associating each token with an email address also creates a durable identity-to-credential mapping. ### Attack Path 1. A user completes OTP verification. 2. The Audos API returns an `authToken`. 3. Following the Skill instructions, the agent persistently stores the token under the user's email address. 4. An attacker obtains access to the agent's state, memory, backup, or credential storage. 5. The attacker extracts the non-expiring bearer token. 6. The attacker reuses it against authenticated Audos endpoints, including workspace status, chat, and rebuild operations. ### Impact Assessment A stolen token could allow unauthorized access to the corresponding Audos workspace for an indefinite period. Based on the documented endpoints, the attacker could retrieve workspace and build information, interact with Ott ...[truncated 228 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace non-expiring bearer tokens with short-lived, narrowly scoped access tokens. - Implement refresh-token rotation, explicit revocation, and device or session management. - Store credentials only in an operating-system-backed or platform-provided secret manager. - Never save tokens in conversational memory, plaintext configuration files, logs, shell history, or general-purpose agent state. - Decouple user identifiers such as email addresses from raw credential values where possible. - Define credential retention and secure deletion policies. - Require reauthentication for sensitive operations such as workspace rebuilds. - Document a response procedure for token compromise, including immediate revocation and rotation. ]]>