T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check_providers.py:27- Finding
Provider-check output discloses API key prefixes
- Content
View full analysis
5, "key_preview": f"{key[:8]}..." if key else "", "custom_url": url or None, }) return result ``` ### Technical Analysis The provider-check script reads API credentials from environment variables and includes the first eight characters of each credential in its JSON result. The script subsequently prints this structure to standard output. Even a partial secret should not be exposed unless operationally necessary. Command output can be retained in agent transcripts, CI/CD logs, terminal recordings, monitoring platforms, or support bundles. The prefix may identify the provider, credential family, account configuration, or a specific credential when correlated with other leaked information. The declared functionality only requires determining whether a provider is configured. Returning a credential substring exceeds that minimum requirement. ### Attack Path 1. A user or automation environment configures one or more provider API keys. 2. The Skill executes `scripts/check_providers.py`. 3. The script reads each key from the process environment. 4. The first eight characters are inserted into `key_preview`. 5. The resulting JSON is printed to standard output. 6. An actor with access to agent transcripts, build logs, or terminal output obtains the exposed prefixes and correlates them with other credential information. ### Impact Assessment This issue does not directly reveal the entire credential, but it unnecessarily reduces secret confidentiality and entr ...[truncated 218 chars]- Remediation
View remediation