T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:303
- Finding
- API Key Exposed Through Terminal Output## Vulnerability Details **File Location**: `SKILL.md`, lines 303–309 **Vulnerability Type**: Credential disclosure through insecure troubleshooting guidance **Risk Level**: Medium ```bash ### Troubleshooting: API Key Issues 1. Check that the `MATON_API_KEY` environment variable is set: ```bash echo $MATON_API_KEY ``` ``` ### Technical Analysis The troubleshooting procedure instructs users or agents to print the complete `MATON_API_KEY` bearer credential to standard output. Verifying whether an environment variable is configured does not require revealing its value. Terminal output may be retained in agent tool transcripts, CI/CD logs, shell recordings, support bundles, screen recordings, or copied diagnostic messages. Because the Skill uses this value directly as an authorization bearer token for `gateway.maton.ai` and `ctrl.maton.ai`, disclosure can enable credential reuse. The broader transmission of the key and Gmail data to Maton's HTTPS endpoints is explicitly declared and is consistent with the Skill's third-party managed OAuth gateway design. The confirmed vulnerability is the unnecessary display of the complete secret, not the documented gateway transmission itself. ### Attack Path 1. A user experiences an authentication problem and follows the documented troubleshooting steps. 2. The user or agent runs `echo $MATON_API_KEY`. 3. The complete API key appears in terminal output. 4. That output is retained in a log, agent transcript, recording, or diagnostic report, or is shared with another party. 5. A party with access to the exposed output extracts the key. 6. The party submits the key as a bearer credential to Maton's gateway or connection-management API. 7. Subject to the key's server-side permissions and active OAuth connections, the party may access Gmail data or perform supported mailbox and connection-management operations. ### Impact Assessment A disclosed key may permit impersonation of ...[truncated 603 chars]
- Remediation
- ## Remediation Suggestions Replace the secret-printing command with a non-disclosing presence check: ```bash if [ -n "${MATON_API_KEY:-}" ]; then echo "MATON_API_KEY is set" else echo "MATON_API_KEY is not set" fi ``` Additional hardening measures: 1. Explicitly warn users never to print, paste, log, or share the API key. 2. Redact authorization headers and environment-variable values from agent output, CI logs, support bundles, and error telemetry. 3. If partial identification is required, display only a short fingerprint derived from the key rather than any reusable portion. 4. Rotate any key that has already appeared in logs, transcripts, recordings, or support messages. 5. Apply least-privilege Gmail OAuth scopes and restrict each key to only the connections and operations required. 6. Provide key revocation, expiration, and audit-log review procedures in the troubleshooting documentation. 7. Clearly communicate that Maton is a third-party processor for Gmail request and response data so users can make an informed authorization decision.