T09 · Insecure Skill Coding Practices
- Location
scripts/yuque_cli.py:132- Finding
Yuque API Token Exposure Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/yuque_cli.py, lines 132 and 176
Vulnerability Type: API credential exposure through process arguments
Risk Level: MediumVulnerable Code
python parser.add_argument("--token", help="Yuque API token (or set YUQUE_TOKEN env var)")python token = args.token or os.environ.get("YUQUE_TOKEN")Technical Analysis
The CLI permits users to supply the Yuque API token through the
--tokencommand-line argument. Command-line arguments are not an appropriate channel for secrets because they may be exposed through process inspection facilities, shell history, operating-system audit records, CI/CD job metadata, terminal logs, or endpoint-monitoring telemetry.The environment-variable authentication mechanism already implemented by the script is sufficient for its declared functionality. Consequently, accepting the same credential through an exposed process argument exceeds the minimum secret-handling surface necessary for the Skill.
The token is subsequently used as the
X-Auth-Tokenheader for requests to the fixed HTTPS Yuque API endpoint. That network transmission is necessary for authentication and no evidence indicates that the token is sent to an unrelated service. The vulnerability is specifically the command-line input mechanism, not the authenticated communication with Yuque.Attack Path
- A user invokes the CLI with a command such as:
bash python scripts/yuque_cli.py --token SECRET_VALUE docs user/repository - The complete command line, including
SECRET_VALUE, becomes observable through one or more local mechanisms, such as process listings, shell history, audit logs, job logs, or monitoring telemetry. - A local user, administrator, monitoring-system operator, or attacker with access to those records retrieves the token.
- The attacker supplies the recovered token in an
X-Auth-Tokenheader to the Yuque AP ...[truncated 907 chars]
- A user invokes the CLI with a command such as:
- Remediation
View remediation
Remediation Suggestions
- Remove the
--tokencommand-line option so credentials cannot be supplied through process arguments. - Continue reading the token from
YUQUE_TOKEN, preferably injected through a properly protected secret manager rather than a persistent shell configuration file. - If interactive entry is necessary, use
getpass.getpass()so the token is not echoed or retained in shell history:python import getpass import os token = os.environ.get("YUQUE_TOKEN") if not token: token = getpass.getpass("Yuque API token: ") - Ensure application, CI/CD, audit, and telemetry logs never record the token or authentication header.
- Document the recommended secure credential setup and discourage embedding the token in scripts, aliases, command history, or repository files.
- Revoke and rotate any token previously passed through
--tokenif it may have been captured in process metadata or logs. - Assign the Yuque token only the minimum server-side permissions required for the intended document operations.
- Remove the