T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:89- Finding
Apify API Token Exposed in URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 89–103
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
bash **REST API fallback (Instagram):** ```bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"keywords": ["[hashtag1]", "[hashtag2]"], "maxItems": 100}'REST API fallback (TikTok):
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"keywords": ["[hashtag1]", "[hashtag2]"]}'text ### Technical Analysis The documented REST fallback places the `APIFY_TOKEN` credential directly in the request URL. The token is sent to the intended Apify API over HTTPS and is required to authenticate the actor run; therefore, the network request itself is consistent with the Skill's declared functionality. However, putting authentication credentials in a URL is an insecure coding practice. URLs are commonly recorded by reverse proxies, API gateways, server access logs, monitoring systems, tracing infrastructure, shell-debug output, and command-history or process-observation tooling. HTTPS protects the request from passive interception in transit, but it does not prevent the full URL from being exposed at endpoints or within authorized intermediary infrastructure. The credential disclosure is unnecessary because authentication can be provided through an HTTP authorization header. Consequently, the query-string approach exposes the token beyond the minimum scope required to invoke the Apify actors. ### Attack Path 1. A user follows one of the documented REST fallback examples with `APIFY_TOKEN` set. 2. The shell expands `$APIFY_TOKEN` into the request URL. 3. The complete URL is captured by server access logs, an API gat ...[truncated 1067 chars]- Remediation
View remediation
Remediation Suggestions
Remove
token=$APIFY_TOKENfrom both URLs and provide the credential through an authorization header instead:bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"keywords": ["[hashtag1]", "[hashtag2]"], "maxItems": 100}'Apply the same authentication pattern to the TikTok request:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tiktok-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"keywords": ["[hashtag1]", "[hashtag2]"]}'Additional hardening measures:
- Use an Apify token restricted to the minimum permissions required by this Skill.
- Ensure authorization headers and environment-variable values are redacted from logs, traces, and diagnostic output.
- Do not enable shell tracing while commands involving credentials are running.
- Rotate the token immediately if it may already have appeared in retained URL or command logs.
- Establish periodic credential rotation and revoke unused tokens.