T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/get_stock.sh:11
- Finding
- Hard-Coded QVeris API Credential in Distributed Script<![CDATA[ ## Vulnerability Details **File Location**: `scripts/get_stock.sh:11` **Vulnerability Type**: Hard-coded API credential **Risk Level**: High ### Vulnerable Code ```bash export QVERIS_API_KEY=sk-[REDACTED_EXPOSED_API_KEY] ``` The credential value has been redacted from this report to avoid further disclosure. ### Technical Analysis The script embeds a QVeris API key directly in source code and exports it to the environment of the subsequently executed process. Anyone who can access the Skill package, source repository, archive, build artifact, or relevant version history can retrieve the original credential. Environment variables may also become visible to child processes and, depending on operating-system permissions and runtime configuration, process-inspection or diagnostic tooling. The key resembles an operational secret, although its current validity and granted permissions were not tested during this static audit. ### Attack Path 1. An attacker obtains a copy of the publicly or internally distributed Skill package. 2. The attacker opens `scripts/get_stock.sh` and extracts the API key from line 11. 3. The attacker submits requests to the associated QVeris service using the stolen credential. 4. Requests are attributed to the credential owner until the key is revoked, expires, or is otherwise disabled. ### Impact Assessment The attacker may obtain all API capabilities granted to the exposed key. Depending on the service-side authorization and account configuration, this could result in: - Unauthorized QVeris API requests. - Consumption or exhaustion of API quotas. - Financial charges associated with unauthorized usage. - Access to data or operations permitted to the credential. - Loss of request attribution and audit-log integrity. - Service disruption for legitimate users if limits are exhausted. This finding does not establish operating-system access or privilege escalation. Its scope is limited to the permissions assigned to the exp ...[truncated 26 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Revoke the exposed credential immediately and issue a replacement. 2. Remove the credential from the current source tree and all distributable artifacts. 3. Purge the exposed value from version-control history where feasible. Rotation remains mandatory because history rewriting does not invalidate existing copies. 4. Obtain the credential from a protected environment variable or secret-management service: ```bash if [ -z "${QVERIS_API_KEY:-}" ]; then echo "Error: QVERIS_API_KEY must be supplied securely." >&2 exit 1 fi export QVERIS_API_KEY ``` 5. Never include the replacement key in source code, documentation, examples, logs, or package metadata. 6. Apply least privilege to the replacement key, including endpoint restrictions, rate limits, expiration, and network restrictions where supported. 7. Review API access logs for unauthorized activity involving the exposed credential. 8. Add secret scanning to local hooks and CI/CD pipelines to prevent recurrence. ]]>