T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:62
- Finding
- GitHub Token Persisted in an Authenticated Git Remote URL## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: Credential exposure through an authenticated URL **Risk Level**: High ```bash git remote add origin https://${GITHUB_TOKEN}@github.com/username/repo.git ``` ### Technical Analysis The command expands `GITHUB_TOKEN` directly into the Git remote URL. Git normally stores this URL in the repository's `.git/config` file. The credential may also be captured by shell tracing, command logging, process inspection, diagnostic output, backups, or accidental disclosure of repository metadata. Although the destination is the legitimate GitHub domain rather than an attacker-controlled endpoint, persisting a bearer token in plaintext violates secure credential-handling practices. Anyone who obtains the expanded URL can authenticate with the permissions assigned to the token until it expires or is revoked. ### Attack Path 1. The Skill obtains `GITHUB_TOKEN` from the execution environment. 2. The shell expands the token inside the remote URL. 3. Git writes the expanded URL to `.git/config`. 4. A local user, diagnostic process, backup reader, log reader, or subsequent automated task obtains the stored URL. 5. The exposed token is extracted from the URL. 6. The token is reused through Git or the GitHub API to access resources authorized by its scopes. ### Impact Assessment Successful exploitation grants access equivalent to the compromised token. Depending on its scopes, this can include reading private repositories, pushing arbitrary commits, modifying releases, creating repositories, altering repository settings, or accessing organization resources. The impact is constrained by the token's permissions and any organization-level access controls.
- Remediation
- ## Remediation Suggestions - Keep the Git remote URL free of credentials, for example: ```bash git remote add origin https://github.com/username/repo.git ``` - Authenticate through a secure Git credential helper, GitHub CLI, or an ephemeral `GIT_ASKPASS` implementation. - Prefer short-lived, narrowly scoped credentials over long-lived personal access tokens. - Disable shell tracing while credentials are in use and redact authenticated URLs from logs and diagnostics. - Inspect existing `.git/config` files and logs for exposed tokens. - Revoke and rotate any token that may already have been persisted.