T09 · Insecure Skill Coding Practices
- Location
SKILL.md:76- Finding
Apify API Token Exposed in URL Query String
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 76
Vulnerability Type: API credential exposure through a URL query parameter
Risk Level: MediumVulnerable Code
bash curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{"keywords": ["#[brand]", "#[brand]review"], "maxItems": 200}'Technical Analysis
The REST fallback embeds
APIFY_TOKENin the request URL. When the shell expands the environment variable, the secret becomes part of thecurlcommand-line argument and request target.URL-based credentials may be exposed through local process inspection, shell or terminal diagnostics, HTTP client debugging, proxy and gateway logs, monitoring systems, and server access logs. Query strings are commonly retained more broadly than authorization headers. Anyone who obtains the token can authenticate to Apify with the permissions assigned to that token.
Attack Path
- A user follows the documented REST API fallback while
APIFY_TOKENis set. - The shell expands
$APIFY_TOKENinto the URL passed as a command-line argument tocurl. - A local observer, diagnostic collector, proxy, gateway, or logging system records the command or request URL.
- An attacker obtains the token from the captured URL.
- The attacker reuses it against the Apify API to perform operations authorized for that token.
Impact Assessment
Successful exploitation compromises the privileges associated with the exposed Apify token. Depending on its configured scope, an attacker could consume paid platform resources, start actor runs, access associated Apify resources or run data, and cause financial or operational impact. This does not directly grant host-system privileges unless the compromised Apify account or its actors separately provide such capabilities.
- A user follows the documented REST API fallback while
- Remediation
View remediation
Remediation Suggestions
Pass the token through an authorization header rather than the query string:
bash curl -X POST \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"keywords":["#[brand]","#[brand]review"],"maxItems":200}' \ "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs"Additional hardening measures:
- Use a least-privilege Apify token scoped only to the resources required by this Skill.
- Avoid printing request headers or enabling verbose HTTP diagnostics where secrets could be recorded.
- Redact credentials from application, proxy, gateway, and CI/CD logs.
- Store the token in a protected secret manager or environment variable rather than source-controlled files.
- Rotate the existing token if the documented command has already been used in an environment where command lines or URLs may have been logged.
- Review Apify account activity and billing for unauthorized actor runs.