T09 · Insecure Skill Coding Practices
Error
- Location
- main.py:7
- Finding
- Hardcoded SkillPay API Credential## Vulnerability Details **File Location**: `main.py`, lines 7–8 **Vulnerability Type**: Hardcoded secret in source code **Risk Level**: High ### Vulnerable Code ```python SKILLPAY_API_KEY = "sk_8b36c2ca9e774eb0243752f907b086e78c8af866a4088d3e3475113ed446b71" SKILLPAY_API_BASE = "https://api.skillpay.me" ``` ### Technical Analysis A secret-looking SkillPay API credential is embedded directly in distributable source code. Any person or system with access to the project package can recover this value without authentication. Although `main.py` does not currently use the credential and the configured entry point is `python bare.py`, inclusion in the package still constitutes credential exposure. Static analysis cannot establish whether the key is active, expired, revoked, or which permissions it grants. Removing it from the current file alone may also be insufficient if it exists in repository history, build artifacts, logs, caches, or previously distributed packages. ### Attack Path 1. An attacker obtains the project source, package, build artifact, or repository history. 2. The attacker reads `main.py` and extracts `SKILLPAY_API_KEY`. 3. The attacker attempts to authenticate to `https://api.skillpay.me` using the exposed key. 4. If the credential remains valid, the attacker invokes API operations allowed by its assigned permissions. 5. The attacker may continue using the credential until it is revoked, rotated, expired, or blocked by provider-side restrictions. No interaction with the running application is necessary to extract the credential. ### Impact Assessment If the key is valid, an attacker could impersonate the associated API client and obtain all privileges granted to that credential. Depending on provider-side authorization, this could include consuming paid resources, creating unauthorized transactions or payment objects, accessing account-related API data, or disrupting legitimate service usage. The precise scope cannot be confirmed from th ...[truncated 175 chars]
- Remediation
- ## Remediation Suggestions 1. Revoke the exposed credential immediately and issue a replacement; do not assume deletion from the source makes the existing key safe. 2. Remove the credential from the current source, repository history, release archives, build artifacts, logs, and caches where feasible. 3. Supply the replacement through a managed secret store or protected environment variable: ```python import os SKILLPAY_API_KEY = os.environ.get("SKILLPAY_API_KEY") if not SKILLPAY_API_KEY: raise RuntimeError("SKILLPAY_API_KEY is not configured") ``` 4. Do not commit example secrets that resemble usable credentials. Use an unmistakable placeholder in documentation, such as `SKILLPAY_API_KEY=replace_me`. 5. Grant the replacement key only the minimum API permissions required by the application. 6. Apply provider-supported restrictions, such as environment, account, endpoint, source-network, spending, or rate limits. 7. Review SkillPay access and transaction logs for use of the exposed credential and investigate unexpected activity. 8. Add automated secret scanning to pre-commit hooks and CI pipelines to prevent recurrence. 9. Ensure production deployments inject secrets at runtime and prevent secret values from appearing in exception messages or application logs.