T09 · Insecure Skill Coding Practices
- Location
SKILL.md:90- Finding
API Token Exposed in URL Query String
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 90–95
Vulnerability Type: Credential exposure through a URL query parameter
Risk Level: Mediumbash curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{ "keywords": ["#skincarereviews", "#skincareobsessed", "#honestskincarereviews"], "maxItems": 100 }'Technical Analysis
The documented REST fallback expands the
APIFY_TOKENenvironment variable directly into a command-line URL. Although HTTPS encrypts the request in transit, it does not protect the expanded command argument from local process inspection, shell or endpoint audit telemetry, debugging output, command recording, or HTTP access and proxy logs that retain query strings.Secrets placed in URLs also tend to propagate through observability systems more readily than credentials supplied through authorization headers. An attacker who can read one of these local or centralized records may recover a valid Apify token without compromising TLS.
Attack Path
- A user follows the documented REST fallback command while
APIFY_TOKENcontains a valid credential. - The shell expands
$APIFY_TOKENinto the URL passed tocurl. - The complete command or request URL is captured by process inspection, shell or endpoint auditing, debugging telemetry, or an intermediary/access log.
- An attacker with access to that record extracts the token from the
tokenquery parameter. - The attacker submits requests to Apify using the stolen token, subject to the permissions and limits associated with it.
Impact Assessment
Successful exploitation discloses the Apify API credential. The attacker could consume paid actor resources, run jobs, or access Apify data and operations authorized to that token. The exact scope and privileges depend on the token's permissions and the associated account c ...[truncated 86 chars]
- A user follows the documented REST fallback command while
- Remediation
View remediation
Remediation Suggestions
- Remove the token from the request URL and use Apify's supported HTTP authorization header instead.
- Ensure request-debugging, shell tracing, and verbose HTTP logging are disabled when credentials are present.
- Configure proxies and observability systems to redact authorization data and sensitive query parameters.
- Use a narrowly scoped token with only the permissions required to run the intended actor.
- Rotate the token regularly and immediately rotate any token that may have appeared in process telemetry or logs.
- Document secure secret injection through environment variables or a dedicated secret manager without printing the resolved value.