T09 · Insecure Skill Coding Practices
- Location
SKILL.md:78- Finding
API Token Exposure Through URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 78–87
Vulnerability Type: API credential exposure through URL query strings
Risk Level: MediumVulnerable Code
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["#[brand]", "#[brand]ambassador", "#[brand]fam"], "maxItems": 100}'bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"Technical Analysis
The documented REST fallback places the
APIFY_TOKENcredential in URL query parameters. Sending the token to the official Apify endpoint is necessary for authentication, but putting it in a URL is not the least-exposure authentication method.URLs can be retained by shell history, process inspection facilities, HTTP access logs, reverse proxies, monitoring platforms, debugging output, and error-reporting systems. TLS protects the request while it is in transit but does not prevent credential disclosure through these endpoint and infrastructure records.
No evidence indicates intentional exfiltration to an unrelated service. The issue is insecure credential handling in otherwise legitimate network requests.
Attack Path
- A user follows the documented REST fallback with a valid
APIFY_TOKEN. - The expanded URL containing the token is exposed through process metadata, command logging, proxy logs, monitoring telemetry, or error diagnostics.
- An attacker or unauthorized operator with access to one of these records extracts the token.
- The attacker submits authenticated requests to the Apify API using the recovered credential.
- The attacker consumes account resources or accesses Apify data and capabilities permitted to that token until it is revoked or expires.
Impact Assessment
A disclosed token grants the attacker the same Apify privileges assigned to that credential. Depending on account and token ...[truncated 369 chars]
- A user follows the documented REST fallback with a valid
- Remediation
View remediation
Remediation Suggestions
Use an HTTP authorization header rather than a URL query parameter for both actor execution and dataset retrieval:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms":["#[brand]","#[brand]ambassador","#[brand]fam"],"maxItems":100}'bash curl \ "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items" \ -H "Authorization: Bearer $APIFY_TOKEN"Additional hardening measures:
- Use a narrowly scoped token with only the permissions needed to run the specified actor and retrieve its results.
- Avoid command tracing, verbose HTTP output, or diagnostics that print authorization headers.
- Redact credentials from application, proxy, monitoring, and error logs.
- Store the token in a protected secret manager or environment variable rather than source files.
- Ensure
.envfiles are excluded from version control and accessible only to the intended user. - Rotate the token immediately if commands containing it may already have been logged.
- Configure token expiration and usage monitoring where supported.