T09 · Insecure Skill Coding Practices
- Location
README.md:5- Finding
Publicly Exposed Shared Demo Credentials
- Content
View full analysis
Vulnerability Details
File Location:
README.md, line 5
Vulnerability Type: Hardcoded plaintext credentials
Risk Level: HighVulnerable Code Snippet:
text - 账号体系：3diy/123456（演示账号，实际使用需客户自有账号）The documentation exposes the reusable username
3diyand password123456for the external platform. The surrounding text identifies these as demo credentials and notes that customers should use their own accounts, but this does not prevent arbitrary parties from using the disclosed credentials.Technical Analysis
Authentication credentials committed to distributable documentation are available to every person or automated system that can access the package. The password is also weak and predictable. If the account remains active and the platform does not impose compensating restrictions, an attacker can authenticate without authorization.
Because the project contains documentation rather than the platform implementation, the account's exact authorization scope cannot be verified from the audited files. The confirmed defect is therefore the plaintext disclosure itself; access to specific platform resources depends on the permissions assigned to the demo account.
Attack Path
- Obtain the Skill package or view its public
README.md. - Extract the disclosed username and password from line 5.
- Navigate to the declared platform at
https://show.3diy.world. - Attempt authentication using username
3diyand password123456. - If the credentials remain active, access all projects, uploaded data, generation resources, and account functions granted to the shared demo account.
- View or alter shared content, consume service resources, or disrupt other users of that account where the account permissions allow it.
Impact Assessment
Successful exploitation grants the attacker the same privileges as the shared demo account. Depending on server-side authorization, this may permit access t ...[truncated 403 chars]
- Obtain the Skill package or view its public
- Remediation
View remediation
Remediation Suggestions
- Remove the username and password from
README.mdand all distributed package versions. - Immediately rotate or disable the disclosed password and invalidate every active session or token associated with the account.
- Review account authentication logs for unknown logins and inspect projects, uploads, publications, and resource usage for unauthorized activity.
- Replace shared reusable credentials with individual account registration or time-limited invitation links.
- If a demo environment is necessary, provide a read-only account with isolated sample data, strict rate limits, no paid-resource access, and automatically expiring credentials delivered outside the repository.
- Enable multi-factor authentication where supported and enforce a strong, unique password.
- Add secret scanning to pre-commit and CI workflows so credentials cannot be committed to source files or documentation.
- Review repository history and previously published artifacts for the secret. Removing it only from the current revision is insufficient because prior versions may remain accessible.
- Remove the username and password from