Challenge 69 ☆

Welcome to challenge Challenge 69.

Challenge 69: Find the Secret in the Cursor Skill

Agent skills are becoming a popular way to share automation with a team: you drop a folder with a SKILL.md in it, the agent picks it up, and everybody gets the same workflow. Unfortunately that also makes them a very convenient place to "temporarily" park a shared credential.

This application ships a Cursor skill called deploy-preview. The skill lives in the resource folder and is hosted by the backend at /skills/cursor/deploy-preview/SKILL.md.

The skill source is also available on GitHub at src/main/resources/challenges/challenge-70/cursor-skill/deploy-preview/SKILL.md.

Read the skill and submit the staging deploy token that the author inlined "to keep the skill self-contained".

Note

Nothing is encoded or encrypted here: this is exactly what a leaked skill looks like in the wild. A skill is documentation, and documentation gets copied into wikis, tickets, pull requests and chat messages.
💡 Tip: Secrets are often strings, numbers, or encoded values. Copy and paste exactly what you find.

Open /skills/cursor/deploy-preview/SKILL.md and look at the Prerequisites section. The value of STAGING_DEPLOY_TOKEN is the answer.

The same file is in the source tree at src/main/resources/challenges/challenge-69/cursor-skill/deploy-preview/SKILL.md.

Why you should never put a secret in an agent skill

A skill is built to be shared. That is the whole point of it: you write the workflow once and every developer, agent and CI job reuses it. This means a secret in a skill has the worst possible properties:

  • It is copied to every machine that installs the skill, including personal laptops.

  • It ends up in the repository, so it is in the git history forever, even after you "remove" it, forcing you to rotate the secret.

  • It is published to skill marketplaces and registries, where it is indexed and searchable.

  • It is read by the agent and can therefore be echoed into chat transcripts, logs and telemetry belonging to third parties.

  • It is a shared credential, so it is almost never rotated and almost never scoped down.

What to do instead:

- Keep credentials out of the skill and let the skill read them from the environment, for example `$STAGING_DEPLOY_TOKEN`.
- Document *which* variable is required and *where* to obtain it, never the value itself.
- Give every consumer their own short-lived, least-privilege credential instead of one shared team token.
- Scan skill files with a secret scanner in pre-commit and CI, just like you scan source code.
- Treat a secret that ever appeared in a skill as compromised and rotate it.
Note

Skills, rules, prompts, MCP server configurations and agent instruction files are all code as far as your secret management is concerned. If you would not hardcode a token in a .java file, do not hardcode it in a SKILL.md either.

⬅️ Previous
🏠 Main Page
Next ➡️
0

📄 Cursor skill: deploy-preview

This application ships a Cursor skill in its resource folder. The backend hosts it at /skills/cursor/deploy-preview/SKILL.md, which is exactly what an agent would read when the skill is installed.

Fetch the skill from the command line:

curl -sO http://www.wrongsecrets.com/skills/cursor/deploy-preview/SKILL.md

…or read it right here:

Open in new tab

💡 The author inlined the shared staging deploy token so the skill would be "self-contained". Submit that token.