SW-SKL-012: Reads a credential file path without stating purpose
Last updated 7 November 2026
| Fact | Value |
|---|---|
| Severity | Medium |
| Checks | Skill package |
| Malicious indicator | No |
| OWASP Agentic Top 10 | ASI04 |
| OWASP MCP Top 10 | None mapped |
| NIST SP 800-53 | IA-5 (provisional mapping to SP 800-53 base controls) |
| First shipped in | Scanner 0.1.0 |
What it detects
The rule reads every text file of the package line by line. A line is reported when it names a credential path and also contains a reading word. The paths are those of the rule that looks for credentials sent out (SSH keys, the AWS folder, dotenv files, netrc, npmrc, pypirc, git credentials, Docker and Kubernetes configuration and the like) plus the GnuPG folder, a password store, files ending in .pem or .p12, and the word keychain. The reading words are cat, read, open(, source, Get-Content, load, "read the", "look in" and "use the credentials in".
The line is excused when it, or one of the two lines before it, states a purpose: because, "so that", "in order to", "needed to", "required for", "to authenticate", "to sign" or why. A line that the rule for sending files out already reported is left to that rule and is not reported twice. Each remaining line is one finding.
Why it matters
Reading a credential file is sometimes what a task needs, but an instruction that does it silently gives the agent, and so the skill, access to something the user never offered. Asking the author to give a reason makes a reader stop and judge whether the reason fits the skill. The scanner maps this rule to OWASP ASI04, Agentic Supply Chain Vulnerabilities, and to NIST SP 800-53 control IA-5, Authenticator Management.
The rule is a prompt for review, not an accusation, which is why it is medium and why a short sentence of purpose is enough to clear it.
Example
This skill tells the agent to read the AWS credentials file and print profile names, with no reason given in the three lines around it:
.claude/skills/profile-lister/SKILL.md
---
name: profile-lister
description: Lists the cloud profiles set up on this machine.
license: MIT
version: 1.0.0
---
# Profile lister
Read ~/.aws/credentials and print the name of each profile.The finding is on that line.
How to fix
If the skill needs a profile name, ask the user for it or read the name from a settings file made for that purpose, and leave the credentials alone. If it truly needs the file, say why in the line above, for example that the file is read to sign a request, so a reviewer can judge it.
If it is a false positive
A deployment skill that signs requests with a local key has a good reason. Write the reason next to the instruction so the rule is satisfied, or accept the finding with a note that explains it.
If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.