T09 · Insecure Skill Coding Practices
Note
- Location
- scripts/test-scrpt.js:1
- Finding
- Hardcoded API Credential in Source Code## Vulnerability Details **File Location**: `scripts/test-scrpt.js`, line 1 **Vulnerability Type**: Hardcoded secret **Risk Level**: Low ### Vulnerable Code ```javascript const API_KEY = 'abc'; ``` ### Technical Analysis The script embeds an API key directly in its source code instead of obtaining it from the `TEST_API_KEY` environment variable declared in `SKILL.md`. Anyone who can access the source package can recover embedded credentials. The current value appears to be a test placeholder, and the script does not include it in the outbound request. Therefore, no direct credential-based compromise is demonstrated in the reviewed implementation. Nevertheless, this pattern creates a security risk if the value is replaced with a valid credential or reused elsewhere. ### Attack Path 1. An attacker obtains read access to the distributed Skill package or source repository. 2. The attacker opens `scripts/test-scrpt.js`. 3. The attacker extracts the credential from line 1. 4. If the credential is valid for another service or later becomes active, the attacker submits it to that service's API. 5. The attacker performs operations permitted by the credential's assigned privileges and rate limits. ### Impact Assessment If a valid secret were embedded here, an attacker could impersonate the credential owner and invoke any API operations authorized for that key. The scope would be limited to the key's permissions, environment, and service-side restrictions. In the current reviewed code, practical impact is low because the value is test-like and unused.
- Remediation
- ## Remediation Suggestions - Remove the hardcoded `API_KEY` constant. - Read the credential from `process.env.TEST_API_KEY`. - Terminate with a clear error when the required environment variable is absent. - Add the credential only to the authorization header required by the target API. - Never print the credential or include it in error output. - Keep secrets out of source control and distribute them through an approved secret-management mechanism. - Rotate the credential if `abc` has ever represented a valid or reused secret. - Add automated secret scanning to the repository's development and release workflows. A safer initialization pattern is: ```javascript const API_KEY = process.env.TEST_API_KEY; if (!API_KEY) { console.error("Missing TEST_API_KEY"); process.exit(1); } ```