T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:29
- Finding
- Hard-Coded Shared Bearer Token in MCP Configuration## Vulnerability Details **File Location**: `SKILL.md:29-43` **Vulnerability Type**: Hard-coded authentication credential **Risk Level**: Medium The project embeds a reusable bearer token directly in its public documentation and MCP configuration. ```markdown - The built-in Key (`mcp_a84000de01e04920b3690d173630f163`) is a public access key provided by Star Hotel - This Key is designed for community developers and is not a confidential credential - The public Key has rate limits, please apply for an exclusive Key for higher quotas - Application address: https://mcp.agentichotel.cn/apply ## MCP Configuration ```json { "mcpServers": { "aigohotel-mcp": { "url": "https://mcp.aigohotel.com/mcp", "type": "http", "headers": { "Authorization": "Bearer mcp_a84000de01e04920b3690d173630f163" } } } } ``` ``` ### Technical Analysis The value `mcp_a84000de01e04920b3690d173630f163` is statically included in an HTTP `Authorization` header. Anyone who can access the Skill package can extract and replay this token outside the intended Agent environment. The documentation identifies the token as a public access key, so there is no evidence that it grants access to private user accounts or administrative functionality. Nevertheless, using a shared bearer credential creates security and operational risks because the service cannot reliably distinguish legitimate Skill traffic from unauthorized third-party use. Publishing the credential also prevents meaningful confidentiality and makes abuse dependent primarily on server-side rate limits. ### Attack Path 1. An attacker downloads or reads the Skill package. 2. The attacker opens `SKILL.md` and extracts the bearer token from the MCP configuration. 3. The attacker sends independent HTTP requests to `https://mcp.aigohotel.com/mcp` with the copied `Authorization` header. 4. If the server accepts the shared token, the requ ...[truncated 922 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the bearer token from `SKILL.md` and all distributed Skill files. 2. Require the token to be supplied through a runtime secret store, protected environment variable, or platform-managed MCP credential facility. 3. Issue separate, scoped credentials per user, installation, or client rather than relying on one community-wide bearer token. 4. Restrict each credential to the minimum required hotel-search operations. 5. Apply server-side per-client quotas, request throttling, anomaly detection, and audit logging. 6. Avoid logging authorization headers and redact credentials from diagnostic output. 7. Rotate or revoke the exposed token after migrating clients to securely provisioned credentials. 8. If anonymous public access is intentional, remove bearer-token authentication entirely and enforce public access controls server-side instead of presenting a reusable public value as an authorization credential.