T09 · Insecure Skill Coding Practices
- Location
main.py:20- Finding
Unnecessary Storage of Binance API Credentials in a Plaintext Configuration File
- Content
View full analysis
Vulnerability Details
File Location:
main.py:20-24,config.example.json:1-4,README.md:15-18, andSKILL.md:15-18
Vulnerability Type: Plaintext storage and unnecessary use of sensitive credentials
Risk Level: MediumVulnerable Code
main.py:20-24:python with open(CONFIG_FILE, "r", encoding="utf-8") as f: CONFIG = json.load(f) # Binance client initialization client = Client(CONFIG["API_KEY"], CONFIG["SECRET_KEY"])config.example.json:1-4:json { "API_KEY": "your_binance_api_key", "SECRET_KEY": "your_binance_secret_key", "FEISHU_WEBHOOK_URL": "https://open.feishu.cn/open-apis/bot/v2/hook/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" }The installation instructions in
README.md:15-18andSKILL.md:15-18direct users to obtain Binance credentials and place them in the JSON configuration.Technical Analysis
The application loads a Binance API key and secret directly from a plaintext JSON file in the working directory. Plaintext workspace files can be exposed through accidental source-control commits, backups, shared workspace access, overly broad filesystem permissions, support archives, or unrelated processes running under the same account.
These credentials are also unnecessary for the behavior implemented by this project. The only Binance operation is
client.get_klines, which retrieves public market-candle data and does not require authenticated account access. Requiring credentials for a public-data monitoring function violates least-privilege principles and increases exposure without providing a functional security benefit.The application does not itself transmit the credentials to the configured Feishu webhook, and no credential-stealing behavior was identified. Exploitation therefore requires an attacker to obtain access to the user's configuration file or a copy of it.
Attack Path
- A user follows the documentation and stores a real Bi ...[truncated 1318 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the API key and secret requirements for public market-data collection. Initialize the Binance client without credentials when only public endpoints are used.
- Remove
API_KEYandSECRET_KEYfromconfig.example.jsonand update both documentation files so users are not instructed to create unnecessary exchange credentials. - If authenticated functionality is added later, load credentials from environment variables or a platform-managed secret store rather than a JSON file in the workspace.
- Add
config.json,.env, credential exports, generated reports, and other local secret-bearing files to.gitignore. - Apply restrictive filesystem permissions to any unavoidable local secret file so it is readable only by the service account.
- Document that Binance keys must use the minimum required permissions. Disable withdrawals, enable IP allowlisting, and use a dedicated read-only key wherever possible.
- Validate at startup that authenticated credentials are requested only when a feature actually requires a private Binance endpoint.
- Rotate any credentials that have already been stored in a repository, shared workspace, backup, or support archive; deleting an exposed file is not sufficient to revoke copied credentials.