T09 · Insecure Skill Coding Practices
- Location
SKILL.md:114- Finding
Apify API Token Exposed Through Tweet Scraper Command-Line URL
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 114–122
Vulnerability Type: Credential exposure through process arguments and URL logging
Risk Level: MediumVulnerable Code
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "searchTerms": ["[TOPIC] journalist", "[TOPIC] reporter", "writing about [TOPIC]"], "maxItems": 300 }'Technical Analysis
The REST fallback inserts
APIFY_TOKENinto the request URL. When the shell expands this environment variable, the resulting credential may be exposed in thecurlprocess arguments. Depending on the operating-system configuration, other local users or processes may be able to inspect those arguments through process-monitoring facilities.URLs are also commonly captured by shell tracing, debugging output, HTTP proxies, monitoring systems, and request logs. Query parameters are therefore unsuitable for transmitting long-lived API credentials. Although the destination is the declared Apify API and there is no evidence of intentional credential exfiltration, this implementation unnecessarily broadens the token's exposure.
Attack Path
- A user sets
APIFY_TOKENand executes the documented REST fallback. - The shell expands
$APIFY_TOKENinto the URL passed tocurl. - A local process observer, enabled shell trace, proxy, or URL-logging system captures the expanded command or request URL.
- An attacker extracts the token from the
tokenquery parameter. - The attacker reuses the token against the Apify API within the permissions and quotas assigned to the victim's account.
Impact Assessment
Successful exploitation could allow unauthorized use of the affected Apify token. The attacker could invoke actors, consume account resources or credits, and access API operations available to that token. The precise scope ...[truncated 150 chars]
- A user sets
- Remediation
View remediation
Remediation Suggestions
Remove the token from the query string and transmit it in an authorization header:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "searchTerms": ["[TOPIC] journalist", "[TOPIC] reporter", "writing about [TOPIC]"], "maxItems": 300 }'Additionally:
- Disable shell tracing while commands involving credentials are executed.
- Ensure logs and diagnostic output redact authorization headers.
- Use a narrowly scoped token where supported.
- Rotate any token believed to have appeared in process captures, proxy logs, or debugging output.
- Avoid placing credentials directly in command-line arguments whenever a protected credential file or secret manager is available.