T09 · Insecure Skill Coding Practices
Error
- Location
- PUBLISH.md:29
- Finding
- Hardcoded Bocha API Credential in Published Documentation<![CDATA[ ## Vulnerability Details **File Location**: `PUBLISH.md`, line 29 **Vulnerability Type**: Hardcoded secret exposure **Risk Level**: High ### Vulnerable Code ```bash export BOCHA_API_KEY="sk-a2f0234180684fe0adcf6302c6027040" ``` ### Technical Analysis The publishing guide contains a concrete API-key-shaped credential instead of a placeholder. Documentation is included in the distributed skill package and may be copied, indexed, cached, or committed to public repositories. Anyone with access to the package can retrieve this value without authentication. If the credential is still valid, an attacker can use it as a bearer credential when sending requests to the Bocha API. The presence of the secret also contradicts the document's own guidance against hardcoded API keys. ### Attack Path 1. An attacker downloads or reads the published skill package. 2. The attacker searches the package for common secret prefixes such as `sk-`. 3. The attacker extracts the credential from `PUBLISH.md`. 4. The attacker supplies it as a bearer token in requests to the Bocha API. 5. If the credential remains active, requests are charged against or attributed to the credential owner's account. No access to the victim's local system is required for this exploitation path. ### Impact Assessment If valid, the exposed credential may permit unauthorized use of the associated Bocha API account, including: - Consumption of paid search credits or account balance. - Exhaustion of API quotas and resulting denial of service to the legitimate owner. - Requests attributed to the victim's account. - Potential access to any API operations authorized for that key. The finding does not establish that the credential remains valid or that it grants privileges outside the Bocha API account. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Revoke or rotate the exposed credential immediately through the Bocha account console. 2. Replace the value with an unmistakable placeholder: ```bash export BOCHA_API_KEY="your-bocha-api-key" ``` 3. Review repository history, published archives, release artifacts, and caches for additional copies of the credential. 4. Enable automated secret scanning in pre-commit hooks and CI/CD pipelines. 5. Add patterns for Bocha API keys and generic `sk-` tokens to the scanning rules. 6. Store real credentials only in environment variables or an approved secrets manager. 7. If supported by the provider, restrict replacement keys by scope, quota, source address, and expiration. ]]>