T09 · Insecure Skill Coding Practices
- Location
main.py:7- Finding
Hardcoded SkillPay API Credential in Source Code
- Content
View full analysis
Vulnerability Details
File Location:
main.py, lines 7-8
Vulnerability Type: Hardcoded secret
Risk Level: HighVulnerable Code:
python SKILLPAY_API_KEY = "sk_8b36c2ca9e774eb0243752f907b086e78c8af866a4088d3e3475113ed446b71" SKILLPAY_API_BASE = "https://api.skillpay.me"Technical Analysis
A credential-shaped SkillPay API key is embedded directly in the distributed source code. Any user or system with access to the project package can recover this value without needing privileged runtime access.
The credential is not currently referenced elsewhere in
main.py, andskill.yamlconfiguresbare.pyrather thanmain.pyas the entry point. These facts reduce immediate exposure through normal execution but do not mitigate disclosure: secrets stored in source remain available in distributed archives, source repositories, build artifacts, backups, and logs.Static analysis cannot establish whether the key remains valid or determine its permissions. Nevertheless, it must be treated as compromised because its format and adjacent API base declaration indicate that it was intended as an authentication credential.
Attack Path
- An attacker obtains the Skill package or read access to its source.
- The attacker opens
main.pyand extracts the hardcoded SkillPay API key from line 7. - The attacker sends requests to the declared SkillPay API endpoint using the exposed key as an authentication credential.
- If the key is valid, the attacker invokes any API operations authorized by its assigned account role and scopes.
- The attacker may continue using the key until it is revoked, rotated, or expires.
Impact Assessment
If valid, the exposed credential could permit unauthorized access to the associated SkillPay account or API resources. The precise impact depends on the key's server-side scopes and may include unauthorized API requests, quota or billing consumption, transaction-relate ...[truncated 332 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke the exposed key immediately and issue a replacement; removing it from the current source alone does not invalidate copies already disclosed.
- Remove the credential from the complete repository history, release archives, build artifacts, logs, caches, and backups where feasible.
- Store replacement credentials in a managed secret store or protected runtime environment variable rather than source code.
- Validate that the required secret exists at startup and fail safely without printing its value.
- Assign the replacement key only the minimum API scopes required by the application.
- Apply expiration, rotation, usage limits, and source restrictions where supported by SkillPay.
- Review API and account audit logs for suspicious activity involving the exposed key.
- Add automated secret scanning to local development, continuous integration, and release workflows to prevent recurrence.