T09 · Insecure Skill Coding Practices
- Location
SKILL.md:1193- Finding
Hard-Coded API Signing Secret Exposed in Skill Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 1193–1199
Vulnerability Type: Hard-coded authentication material
Risk Level: MediumTechnical Analysis
The Skill embeds a reusable application signing secret directly in its instructions and tells the Agent how to construct an authentication signature:
text API endpoint: POST https://autoglm-api.zhipuai.cn/agentdr/v1/assistant/skills/web-search Request body: {"queries": [{"query": "<search term>"}]} Authentication headers: X-Auth-Appid: 100003 X-Auth-TimeStamp: current Unix timestamp in seconds X-Auth-Sign: MD5("100003" + "&" + timestamp + "&" + "38d2391985e2369a5fb8227d8e6cd5e5") Authorization: Bearer token retrieved from http://127.0.0.1:18432/get_tokenBecause
SKILL.mdis distributed to and readable by Skill consumers, the value38d2391985e2369a5fb8227d8e6cd5e5cannot remain confidential. Anyone who obtains the Skill can reproduce the application-signature component for arbitrary current timestamps.The API additionally requires a bearer token obtained from a local token broker, so the embedded signing secret alone does not establish a complete remote authentication bypass. Exploitation requires access to a valid bearer token, such as access to a runtime where the documented localhost token broker is available. Nevertheless, embedding reusable signing material defeats the intended secrecy of that authentication factor and increases the consequences of bearer-token exposure.
Attack Path
- An attacker obtains or reads the distributed
SKILL.md. - The attacker extracts the application ID, signature construction algorithm, and hard-coded signing secret.
- The attacker obtains a valid bearer token. In an affected runtime, this may involve access to the documented local token endpoint at
http://127.0.0.1:18432/get_token. - The attacker selects a current Unix timestamp and calculates the documented MD5 sig ...[truncated 1012 chars]
- An attacker obtains or reads the distributed
- Remediation
View remediation
Remediation Suggestions
- Remove the signing secret and signature-construction material from
SKILL.md. - Rotate the exposed secret because it must be treated as compromised once distributed.
- Generate signatures inside a trusted backend or credential broker that does not reveal reusable signing material to the Agent or Skill consumer.
- Return only short-lived, audience-restricted authorization artifacts to the caller.
- Restrict locally issued tokens by API audience, operation, rate limit, expiration, and runtime identity.
- Require authentication and caller authorization on the localhost token endpoint rather than relying solely on loopback reachability.
- Avoid exposing bearer tokens in model-visible content, logs, diagnostics, or generated output.
- Monitor application ID
100003for unexpected usage and revoke tokens or credentials associated with anomalous requests.
- Remove the signing secret and signature-construction material from