T09 · Insecure Skill Coding Practices
- Location
SKILL.md:116- Finding
API Token Exposed Through a Command-Line URL
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 116–122
Vulnerability Type: API credential exposure through a URL and process arguments
Risk Level: MediumVulnerable Code
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "searchTerms": ["[TOPIC_KEYWORD]"], "maxItems": 500, "tweetLanguage": "en", "since": "[YYYY-MM-DD]" }'Technical Analysis
The documented REST fallback interpolates
APIFY_TOKENinto the request URL. When the shell expands this variable, the secret becomes part of curl's command-line arguments and the complete request URL.Command-line arguments may be visible to other local users or monitoring software through process-inspection facilities. Credential-bearing URLs may also be retained in application, reverse-proxy, API gateway, observability, or server access logs. TLS protects the URL while it is transmitted over the network, but it does not prevent exposure through local process inspection or endpoint-side logging.
Attack Path
- A user follows the documented REST fallback with a valid
APIFY_TOKEN. - The shell expands the token into curl's URL argument.
- A local process observer, monitoring agent, or user with access to relevant URL logs records the credential-bearing URL.
- The observer extracts the token from the
tokenquery parameter. - The exposed token is replayed against the Apify API within the permissions and lifetime assigned to that token.
Impact Assessment
Successful exploitation discloses the Apify API token. An attacker could authenticate to Apify with the token's effective privileges, potentially start actor runs, consume paid platform resources, access resources available to that credential, and cause financial or operational impact. The exact scope is limited by the token's permissions, associated ...[truncated 59 chars]
- A user follows the documented REST fallback with a valid
- Remediation
View remediation
Remediation Suggestions
Remove the token from the URL and transmit it in an authorization header:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "searchTerms": ["[TOPIC_KEYWORD]"], "maxItems": 500, "tweetLanguage": "en", "since": "[YYYY-MM-DD]" }'Additionally:
- Use a least-privilege token restricted to only the resources required by this Skill.
- Store the token in a protected secret manager or environment variable rather than source-controlled files.
- Ensure scripts and diagnostic output do not print authorization headers or environment variables.
- Redact credentials in application, proxy, API gateway, and observability logs.
- Rotate any token previously used in a query string if relevant process or request logs may have been accessible.
- Configure expiration and periodic rotation where supported.