T09 · Insecure Skill Coding Practices
- Location
scripts/test_env.py:5- Finding
Private-Key Material Disclosed to Standard Output
- Content
View full analysis
Vulnerability Details
File Location:
scripts/test_env.py, lines 5-7
Vulnerability Type: Sensitive credential exposure through diagnostic output
Risk Level: MediumVulnerable Code:
python pk = os.environ.get("EUSKALMET_API_PRIVATE_KEY") if pk: print(f"FOUND: Starts with {pk[:30]}...") print(f"Line count: {len(pk.splitlines())}")Technical Analysis
The credential-testing script reads
EUSKALMET_API_PRIVATE_KEYfrom the environment and prints its first 30 characters. Private-key material must never be emitted to standard output, even partially. Terminal output may be retained in shell logs, CI/CD logs, agent execution transcripts, monitoring systems, or support diagnostics.The script does not transmit the private key over the network, and the reviewed code contains no evidence of intentional credential exfiltration. Nevertheless, exposing a recognizable private-key prefix violates secret-handling best practices and creates an unnecessary disclosure path. Printing the key's line count also reveals structural metadata that is not required to establish whether the credential exists.
Attack Path
- A user stores the Euskalmet private key in
.envas documented. - The user runs
scripts/test_env.pyto validate the environment. - The script loads the private key into memory.
- The first 30 characters and line-count metadata are written to standard output.
- An execution environment, agent transcript, CI system, terminal recorder, or log collector retains that output.
- An attacker with access to those logs obtains a fragment and structural information about the private key.
- The fragment may be correlated with other disclosures or used to identify the key format and affected credential.
Impact Assessment
This issue does not independently disclose the complete private key or directly grant API access. Its immediate scope is partial exposure of an authenticatio ...[truncated 381 chars]
- A user stores the Euskalmet private key in
- Remediation
View remediation
Remediation Suggestions
-
Never print any portion, hash, length, line count, or format details of a private key.
-
Replace the diagnostic output with a boolean presence check:
python pk = os.environ.get("EUSKALMET_API_PRIVATE_KEY") if pk: print("EUSKALMET_API_PRIVATE_KEY is configured.") else: print("EUSKALMET_API_PRIVATE_KEY is not configured.") -
If credential validity must be tested, sign a short-lived JWT and make a minimal authenticated request to the expected official API endpoint without logging the token or key.
-
Configure CI and agent environments to redact credential-related environment variables from logs.
-
Rotate the private key if the existing script has been executed in an environment whose output was retained or shared.
-