T09 · Insecure Skill Coding Practices
- Location
SKILL.md:92- Finding
Apify API Token Exposed in Tweet Scraper Request URL
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 92–95
Vulnerability Type: API credential exposure through a URL query parameter
Risk Level: MediumComplete Code Snippet:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["UX designer", "product designer", "portfolio", "[DISCIPLINE] open to work"], "maxItems": 300}'Technical Analysis
The REST fallback places
APIFY_TOKENin the URL query string. When the shell expands the environment variable, the resulting credential-bearing URL can be exposed through command telemetry, process inspection, debugging output, proxy and access logs, monitoring platforms, or copied command output.TLS protects the URL while it is transmitted to Apify, but it does not prevent the plaintext URL from being recorded at the client, intermediary infrastructure, or destination. Authentication secrets should therefore be carried in Apify's supported authorization header rather than in query parameters.
Attack Path
- A user exports a valid
APIFY_TOKENand executes the documentedcurlcommand. - The shell expands
$APIFY_TOKENinto the command-line URL. - A local monitoring agent, command logger, process observer, proxy, or API access-log system records the expanded URL.
- An attacker with access to that record extracts the token from the
tokenquery parameter. - The attacker submits requests to Apify using the stolen credential.
Exploitation requires access to a location where the expanded command or request URL was retained; the document does not itself transmit the token to any undeclared endpoint.
Impact Assessment
A stolen token can grant access to the Apify operations authorized for the associated account. Depending on the token's permissions, an attacker could run actors, consume paid platform resources, access actor ...[truncated 168 chars]
- A user exports a valid
- Remediation
View remediation
Remediation Suggestions
- Remove
token=$APIFY_TOKENfrom the request URL. - Use Apify's supported HTTP authorization header, for example:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["UX designer", "product designer", "portfolio", "[DISCIPLINE] open to work"], "maxItems": 300}' - Ensure HTTP clients, shell tracing, CI systems, and monitoring tools redact authorization headers and secret environment variables.
- Store the token in a dedicated secret manager or protected environment variable rather than source files or command history.
- Apply least-privilege permissions and usage limits to the token.
- Rotate any token that may previously have appeared in logs, telemetry, screenshots, or shared command output, and review Apify activity for unauthorized use.
- Remove