T09 · Insecure Skill Coding Practices
- Location
SKILL.md:75- Finding
Apify API Token Exposed in URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 75-83
Vulnerability Type: Credential exposure through command-line URL query parameters
Risk Level: Mediumbash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["#affiliate[niche]", "#[niche]code", "use code [NICHE]", "#commissioned"], "maxItems": 100}'Wait for
SUCCEEDED. Fetch dataset:bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"Technical Analysis
The documented REST fallback expands the
APIFY_TOKENenvironment variable directly into two request URLs. Although HTTPS protects the URL while it is transmitted over the network, placing credentials in query parameters creates additional exposure surfaces that are not present when an authorization header is used.The expanded URL can be visible in the local process argument list while
curlis running. Query strings may also be retained by HTTP access logs, gateways, proxies, monitoring systems, error reports, or debugging telemetry. Personnel or systems with access to those records could recover the bearer credential.Authentication to Apify is required for the Skill's declared social-media scraping functionality. However, transmitting the credential through URL parameters exceeds the minimum-risk implementation necessary because Apify API authentication can instead be supplied through an HTTP authorization header.
Attack Path
- A user follows the REST fallback instructions with
APIFY_TOKENset in the environment. - The shell expands
$APIFY_TOKENinto the URL passed as a command-line argument tocurl. - A local user with sufficient process-inspection access, or a party with access to proxy, gateway, monitoring, or service logs containing query strings, observes the expanded URL.
- The party extracts th ...[truncated 947 chars]
- A user follows the REST fallback instructions with
- Remediation
View remediation
Remediation Suggestions
Remove the API token from every URL and supply it through an authorization header instead:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["#affiliate[niche]", "#[niche]code", "use code [NICHE]", "#commissioned"], "maxItems": 100}'Retrieve the dataset using the same header-based authentication pattern:
bash curl \ "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items" \ -H "Authorization: Bearer $APIFY_TOKEN"Additional hardening measures:
- Use a dedicated token with the narrowest permissions supported for actor execution and dataset retrieval.
- Do not enable shell tracing or verbose HTTP logging around authenticated commands.
- Configure gateways, proxies, and monitoring systems to redact authorization data and sensitive query parameters.
- Avoid printing the token or expanded authenticated commands in diagnostic output.
- Rotate the token if URLs containing it may already have been captured in process telemetry or infrastructure logs.
- Ensure any referenced helper script reads the token securely and never places it in command-line arguments or output. The referenced
scripts/run_actor.jswas not present in the audited project and therefore could not be inspected.