SW-SKL-011: Hard-coded credential in the package
Last updated 7 November 2026
| Fact | Value |
|---|---|
| Severity | Critical |
| Checks | Skill package |
| Malicious indicator | No |
| OWASP Agentic Top 10 | None mapped |
| OWASP MCP Top 10 | MCP01 |
| NIST SP 800-53 | IA-5 (provisional mapping to SP 800-53 base controls) |
| First shipped in | Scanner 0.1.0 |
What it detects
The rule reads every text file of the package line by line. A line is reported when it holds a credential in a known shape, matched exactly and with case: an AWS access key (AKIA or ASIA and sixteen capitals or digits), a GitHub token (ghp_, gho_, ghu_, ghs_ or ghr_ followed by at least 36 characters, or github_pat_), a GitLab token (glpat-), a Slack token (xox and a letter), an Anthropic key (sk-ant-) or another sk- key, a Google API key (AIza), a private key header, or a JSON web token with two eyJ parts.
A line is also reported when a name containing password, passwd, secret, apikey, api_key, api-key or token is assigned with = or : a quoted value of at least eight characters with no space, unless that value looks like a placeholder: it holds xxx, three dots, an angle bracket, "your_" or "your-", example, changeme, or a shell variable reference. The evidence is the line with credentials masked.
Why it matters
A credential stored in a skill is readable by everyone who can read the skill, and a published package is read by many people and by automated collectors. Once such a value has been seen it has to be treated as exposed, whatever happens to the file afterwards. The scanner maps this rule to OWASP MCP01, Token Mismanagement & Secret Exposure, and to NIST SP 800-53 control IA-5, Authenticator Management.
Example
This skill carries an AWS access key in a code block. The value is a sample key whose last characters read EXAMPLE, so it opens nothing:
.claude/skills/cloud-uploader/SKILL.md
---
name: cloud-uploader
description: Uploads build artefacts to a storage bucket.
license: MIT
version: 1.0.0
---
# Cloud uploader
Upload the files with the settings below.
```sh
export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
```The finding is on the line with the export, and its evidence masks the key.
How to fix
Remove the value from the package and revoke the credential at its provider, because a removed file does not make a seen secret safe again. Have the skill read the value from an environment variable or the user's secret store, and write the variable's name in its instructions.
If it is a false positive
A documentation sample or a test fixture can have the shape of a key. If the value is invented, make that obvious with a word such as EXAMPLE, FAKE or xxxx, which the assigned-value check skips; the known key shapes are matched even then, so accept the finding with a note that says the value is a sample.
If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.