T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:98- Finding
Apify API Token Exposed in URL Query String
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 98–108
Vulnerability Type: Credential exposure through a URL query parameter
Risk Level: MediumVulnerable Code
bash **REST API fallback:** ```bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tiktok-comments-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "postURLs": [ "https://www.tiktok.com/@[handle]/video/[VIDEO_ID]" ], "maxCommentsPerPost": 500, "includeReplies": false }'text ### Technical Analysis The Skill instructs users or agents to place `APIFY_TOKEN` directly in an HTTPS URL query string. Although TLS protects the URL while it is in transit, query strings are commonly retained by shell history, command-line auditing, process inspection, proxy and API access logs, observability platforms, and copied command output. Sending data to Apify is necessary for the Skill's declared TikTok scraping function. However, exposing the credential in the URL is not necessary and exceeds the minimum exposure required to authenticate the request. The token should be conveyed through an authorization header so that it is less likely to be recorded by URL-oriented logging systems. No evidence was found that the Skill intentionally sends the token to an unrelated destination. The risk is the insecure transport location and incidental disclosure of a reusable credential. ### Attack Path 1. A user or agent follows the documented REST fallback command with a valid `APIFY_TOKEN`. 2. The expanded command or complete request URL is captured in shell history, process telemetry, command auditing, proxy logs, API access logs, or monitoring data. 3. An attacker with access to one of those records extracts the query-string token. 4. The attacker submits authenticated requests to Apify using the stolen token. 5. Apify operations available to that token can then be perform ...[truncated 583 chars]- Remediation
View remediation
Remediation Suggestions
Remove the token from the query string and send it in an authorization header:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tiktok-comments-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "postURLs": [ "https://www.tiktok.com/@[handle]/video/[VIDEO_ID]" ], "maxCommentsPerPost": 500, "includeReplies": false }'Apply the following additional controls:
- Use an Apify token restricted to the minimum permissions and resources required by this Skill.
- Prevent
.envfiles and credentials from being committed by adding them to.gitignoreand secret-scanning rules. - Restrict permissions on local credential files to the owning user.
- Avoid printing tokens or expanded authenticated commands in logs and diagnostic output.
- Redact existing query parameters in proxy, API gateway, and observability logs.
- Rotate any token that may already have been exposed through command history or request logging.