T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:20- Finding
Grafana Service-Account Token Exposed Through Command-Line Arguments
- Content
View full analysis
/api/azure-mcp","transport":"streamable-http","headers":{"Authorization":"Bearer "}}' ``` ```text Replace `` with your Azure Managed Grafana endpoint and `` with a valid Grafana service-account token (starts with `glsa_`). ``` ### Technical Analysis The setup instructions require users to substitute a Grafana service-account bearer token directly into a shell command. Consequently, the token becomes part of the command-line text. Depending on the operating-system and shell configuration, the secret may be: - Persisted in shell history. - Visible temporarily through process inspection facilities. - Captured by terminal logging or command auditing systems. - Accidentally copied into support logs, documentation, or shared transcripts. The project does not contain a hard-coded credential, but it prescribes an insecure method for supplying a sensitive credential. A Grafana service-account token should be treated as a reusable secret because possession of it may be sufficient to authenticate to the configured Grafana endpoint. ### Attack Path 1. A user follows the documented setup procedure and replaces `` with a valid Grafana service-account token. 2. The shell records the complete command in its history, or a local monitoring process captures the command-line text. 3. A local user or process with access to that history, audit trail, terminal log, or process metadata retrieves the token. 4. The attacker identifies the Grafana endpoint from the same command. 5. The attacker submits authenticated requests using the recovered bearer token. 6. The attacker gains whatever Grafana and Azure-observability access has been grante ...[truncated 722 chars]- Remediation
View remediation