T09 · Insecure Skill Coding Practices
- Location
SKILL.md:92- Finding
Apify API Token Exposed in URL Query String
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 92–96
Vulnerability Type: Sensitive credential exposure through a URL query parameter
Risk Level: MediumComplete Code Snippet:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "keywords": ["[hashtag1]", "[hashtag2]", "[hashtag3]"] }'Technical Analysis
The REST fallback places
APIFY_TOKENin the request URL. Although the token is read from an environment variable rather than hardcoded, expanding it into a query string increases the likelihood of credential disclosure.URLs may be retained by shell or command-execution telemetry, HTTP clients, reverse proxies, gateways, application logs, monitoring platforms, and error reports. Depending on the execution environment, the expanded command may also be observable through process inspection. TLS protects the request while it is in transit but does not prevent the URL from being recorded at either endpoint or by local observability systems.
Attack Path
- A user or agent follows the documented REST fallback with a valid
APIFY_TOKEN. - The shell expands
$APIFY_TOKENinto the URL before invokingcurl. - The complete URL is captured by process telemetry, debugging output, proxy or server access logs, monitoring infrastructure, or another logging mechanism.
- An attacker with access to one of those records extracts the token.
- The attacker submits authenticated requests to Apify using the exposed token.
- The attacker can perform actions permitted by that token until it is revoked, rotated, or otherwise expires.
Impact Assessment
Successful exploitation grants the attacker the same Apify API privileges as the compromised token. Depending on its permissions, this may permit unauthorized actor runs, consumption of account resources or credits, and access t ...[truncated 218 chars]
- A user or agent follows the documented REST fallback with a valid
- Remediation
View remediation
Remediation Suggestions
-
Use Apify's supported authorization-header mechanism instead of placing the token in the URL. For example, where supported:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "keywords": ["[hashtag1]", "[hashtag2]", "[hashtag3]"] }' -
Confirm the exact authentication-header syntax against the current Apify API documentation before publishing the replacement.
-
Configure command, proxy, application, and monitoring logs to redact authorization headers and known secret values.
-
Grant the token only the minimum permissions needed for actor execution and dataset retrieval.
-
Rotate the token if the documented command has already been used in an environment where URLs or process arguments may have been retained.
-
Avoid enabling verbose HTTP or shell tracing while authenticated requests are executed.
-