T09 · Insecure Skill Coding Practices
Warning
- Location
- references/sellersprite-api.md:10
- Finding
- Reusable SellerSprite Session Credentials Are Exposed to the Agent Context<![CDATA[ ## Vulnerability Details **File Location**: `references/sellersprite-api.md:10-23` **Additional Locations**: `SKILL.md:69-74`, `references/multi-platform.md:43-59` **Vulnerability Type**: Exposure and insecure handling of reusable session credentials **Risk Level**: Medium ### Vulnerable Code Snippet ```javascript document.cookie ``` ```http POST https://www.sellersprite.com/v3/api/product-research Content-Type: application/json Cookie: ecookie=...; rank-login-user=...; Sprite-X-Token=... ``` The same credential-handling workflow is also prescribed in `SKILL.md` and `references/multi-platform.md`. ### Technical Analysis The Skill instructs the Agent to extract three reusable SellerSprite session credentials—`ecookie`, `rank-login-user`, and `Sprite-X-Token`—from an authenticated browser session and manually place them into a request header. This unnecessarily exposes authentication material to the Agent's working context, browser-tool results, API-call history, diagnostic output, or execution logs. These values function as bearer-style session credentials: possession may be sufficient to authenticate requests without knowing the account password. No instruction was found that explicitly sends these credentials to an unrelated domain, so this is not confirmed malicious exfiltration. Nevertheless, extracting raw tokens from the browser violates least-exposure principles and creates an avoidable credential-disclosure risk. ### Attack Path 1. The user signs in to SellerSprite by scanning a QR code or entering account credentials. 2. The Agent executes `document.cookie` in the authenticated browser context. 3. SellerSprite cookie and token values are returned to the Agent or browser-tool transcript. 4. The Agent manually places those values in the `Cookie` request header. 5. An attacker obtains the values through exposed logs, shared transcripts, compromised tool output, or accidental inclusion in a generated artifact. 6. The attacker replays t ...[truncated 874 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Keep authentication inside an isolated browser profile and avoid returning raw cookie values to the Agent. 2. Perform authenticated requests through the existing same-origin browser session rather than manually reconstructing the `Cookie` header. 3. If API credentials must be handled outside the browser, store them in a dedicated secret manager and expose them only to the request transport layer. 4. Prevent credentials from appearing in prompts, browser results, debug logs, reports, exception messages, and tool-call histories. 5. Add automatic redaction for `Cookie`, `Authorization`, `ecookie`, `rank-login-user`, and `Sprite-X-Token` values. 6. Restrict requests using these credentials to an explicit allowlist of trusted SellerSprite HTTPS origins. 7. Delete temporary credential material immediately after use and do not persist it in generated JSON or HTML output. 8. Require explicit user confirmation before accessing authenticated account data. 9. Document session revocation and reauthentication procedures in case credential disclosure is suspected. ]]>