T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:29- Finding
Hard-Coded Shared Bearer Token in MCP Configuration
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:29-43
Vulnerability Type: Hard-coded authentication credential
Risk Level: MediumThe project embeds a reusable bearer token directly in its public documentation and MCP configuration.
markdown - The built-in Key (`mcp_a84000de01e04920b3690d173630f163`) is a public access key provided by Star Hotel - This Key is designed for community developers and is not a confidential credential - The public Key has rate limits, please apply for an exclusive Key for higher quotas - Application address: https://mcp.agentichotel.cn/apply ## MCP Configuration ```json { "mcpServers": { "aigohotel-mcp": { "url": "https://mcp.aigohotel.com/mcp", "type": "http", "headers": { "Authorization": "Bearer mcp_a84000de01e04920b3690d173630f163" } } } }text ### Technical Analysis The value `mcp_a84000de01e04920b3690d173630f163` is statically included in an HTTP `Authorization` header. Anyone who can access the Skill package can extract and replay this token outside the intended Agent environment. The documentation identifies the token as a public access key, so there is no evidence that it grants access to private user accounts or administrative functionality. Nevertheless, using a shared bearer credential creates security and operational risks because the service cannot reliably distinguish legitimate Skill traffic from unauthorized third-party use. Publishing the credential also prevents meaningful confidentiality and makes abuse dependent primarily on server-side rate limits. ### Attack Path 1. An attacker downloads or reads the Skill package. 2. The attacker opens `SKILL.md` and extracts the bearer token from the MCP configuration. 3. The attacker sends independent HTTP requests to `https://mcp.aigohotel.com/mcp` with the copied `Authorization` header. 4. If the server accepts the shared token, the requ ...[truncated 922 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the bearer token from
SKILL.mdand all distributed Skill files. - Require the token to be supplied through a runtime secret store, protected environment variable, or platform-managed MCP credential facility.
- Issue separate, scoped credentials per user, installation, or client rather than relying on one community-wide bearer token.
- Restrict each credential to the minimum required hotel-search operations.
- Apply server-side per-client quotas, request throttling, anomaly detection, and audit logging.
- Avoid logging authorization headers and redact credentials from diagnostic output.
- Rotate or revoke the exposed token after migrating clients to securely provisioned credentials.
- If anonymous public access is intentional, remove bearer-token authentication entirely and enforce public access controls server-side instead of presenting a reusable public value as an authorization credential.
- Remove the bearer token from