T09 · Insecure Skill Coding Practices
- Location
SKILL.md:98- Finding
Apify API Token Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 98–107
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["Twitter Spaces [TOPIC]", "join my Space [TOPIC]", "hosting a Space about [TOPIC]", "upcoming Space [TOPIC]"], "maxItems": 100}'bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"Technical Analysis
The documented REST fallback places
APIFY_TOKENin URL query parameters. Although transmitting an authentication credential to Apify is necessary for the declared scraping functionality, embedding it in URLs is unnecessary and increases exposure.Expanded URLs may be retained in shell history, process inspection output, proxy and server access logs, observability platforms, debugging traces, and error reports. HTTPS protects the request in transit but does not prevent credential disclosure through these endpoints and records.
Attack Path
- A user follows the REST fallback and executes one of the documented commands.
- The shell expands
$APIFY_TOKENinto the command-line URL. - The resulting URL is captured in shell history, process telemetry, access logs, monitoring data, or diagnostics.
- An attacker or unauthorized operator obtains access to one of those records.
- The attacker extracts and reuses the token against the Apify API.
- The attacker performs any actions allowed by the token until it is revoked, rotated, or expires.
Impact Assessment
A disclosed token may allow unauthorized use of the victim's Apify account within the token's granted permissions. Potential consequences include running actors, consuming paid resources, accessing available run results or datasets, exposing data ...[truncated 203 chars]
- Remediation
View remediation
Remediation Suggestions
Remove credentials from all URL query parameters and supply the token through an authorization header supported by Apify:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["Twitter Spaces [TOPIC]", "join my Space [TOPIC]", "hosting a Space about [TOPIC]", "upcoming Space [TOPIC]"], "maxItems": 100}'Apply equivalent header-based authentication when retrieving dataset items:
bash curl \ "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items" \ -H "Authorization: Bearer $APIFY_TOKEN"Additional hardening measures:
- Use the narrowest token permissions supported by Apify.
- Store the token in a protected environment variable or secret manager rather than source files.
- Avoid verbose shell tracing while executing authenticated commands.
- Ensure logs and error reports redact authorization credentials.
- Rotate tokens previously used in URL query strings where those URLs may have been recorded.
- Document token revocation and incident-response procedures.