T09 · Insecure Skill Coding Practices
- Location
SKILL.md:89- Finding
API Token Exposed in URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 89–96
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumThe documented REST fallback embeds the Apify API token directly into request URLs:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["[EVENT_NAME] 2026", "[EVENT_NAME] recap", "[EVENT_NAME] announcements", "[EVENT_NAME] highlights"], "maxItems": 100}'Wait for
SUCCEEDED. Fetch dataset:bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"Technical Analysis
Placing an authentication token in a URL query parameter exposes it beyond the HTTP authentication boundary. Although HTTPS protects the URL while it is in transit to Apify, the expanded URL may still become visible in local process listings, diagnostic output, proxy or gateway telemetry, monitoring platforms, HTTP access logs, and error reports.
Authentication is necessary for the Skill's declared Google Search scraping function, and the requests are sent to the expected Apify service. However, transmitting the credential in the URL is not the minimum-risk authentication method. Credentials should be carried in an authorization header or handled by a client that does not expose them in command-line arguments or logged URLs.
Attack Path
- A user or Agent follows the documented REST fallback with
APIFY_TOKENpresent in the environment. - The shell expands
$APIFY_TOKENinside thecurlURL. - The resulting authenticated URL may be exposed through process inspection, command diagnostics, proxy logs, access logs, monitoring telemetry, or copied error output.
- An attacker with access to one of those sources extracts the token.
- The attacker reuses the token against Apify APIs within the permissions grant ...[truncated 488 chars]
- A user or Agent follows the documented REST fallback with
- Remediation
View remediation
Remediation Suggestions
- Replace query-string authentication with Apify's supported authorization-header mechanism.
- Avoid placing credentials in URLs, command-line arguments, generated filenames, logs, or displayed command output.
- Prefer a maintained API client or wrapper that reads the credential from an environment variable and applies it without printing it.
- Ensure debug and error logging redacts authorization headers and tokens.
- Use a narrowly scoped credential where supported, limit its account permissions, and rotate it periodically.
- Revoke and replace the token immediately if an authenticated URL has been logged or disclosed.
- Add explicit documentation warning users not to share command output, process captures, or logs containing authenticated requests.