T09 · Insecure Skill Coding Practices
- Location
SKILL.md:92- Finding
Apify API Token Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 92–97 and 114–119
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tiktok-profile-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"usernames": ["[handle1]", "[handle2]"]}'bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "profiles": ["https://www.tiktok.com/@[handle1]"] }'Technical Analysis
The documented REST fallback embeds
APIFY_TOKENin the request URL. When the shell expands the environment variable, the credential becomes part of the command-line argument and URL.Although HTTPS encrypts the request in transit, it does not protect the token from exposure through local process inspection, shell or terminal logging, debugging output, proxy and access logs, monitoring platforms, error reports, or other systems that retain complete URLs. URL query parameters are commonly recorded more broadly than authorization headers.
Attack Path
- A user sets a valid
APIFY_TOKENand executes one of the documented REST fallback commands. - The shell expands
$APIFY_TOKENinto the URL passed tocurl. - A local observer or logging component captures the process arguments or complete request URL.
- An attacker extracts the exposed token from that record.
- The attacker submits authenticated requests to Apify using the stolen credential.
- The attacker can perform operations allowed by the token until it expires, is revoked, or is rotated.
Impact Assessment
Successful exploitation grants access equivalent to the permissions assigned to the compromised Apify token. Depending on its scope, an attacker could invoke actors, consume paid platform ...[truncated 255 chars]
- A user sets a valid
- Remediation
View remediation
Remediation Suggestions
- Replace query-string authentication with Apify's supported authorization-header mechanism so the token is not included in the URL.
- Avoid passing secrets as command-line arguments wherever possible.
- Ensure diagnostic tooling, proxies, and monitoring systems redact authorization data and sensitive query parameters.
- Do not print expanded credentials in examples, debug output, or error messages.
- Apply least privilege to Apify tokens and use separate tokens for distinct environments or workflows.
- Rotate any token that may previously have been used with these commands and review relevant logs for unintended disclosure.
- Add documentation warning users never to commit
.envfiles or include tokens in saved command transcripts.