T09 · Insecure Skill Coding Practices
- Location
SKILL.md:88- Finding
Apify API Token Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 88–96
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": "[NICHE] channel", "[NICHE] YouTube", "maxItems": 100}'bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"Technical Analysis
Authentication with Apify is necessary for the Skill's declared YouTube research functionality, and the documented requests are sent to the expected
api.apify.comdomain. However, the REST fallback places theAPIFY_TOKENsecret directly in URL query strings.After shell expansion, the complete credential may become visible in process command lines and can be retained by shell history, terminal session recording, command auditing, proxy logs, client diagnostics, monitoring platforms, or other systems that record URLs. HTTPS protects the request while it is in transit but does not prevent disclosure at these endpoints or through operational logging.
The Skill therefore transmits a required credential using a mechanism that exposes it more broadly than the minimum privilege and disclosure necessary for API authentication.
Attack Path
- A user configures a valid
APIFY_TOKENand follows the documented REST fallback. - The shell expands
$APIFY_TOKENinto the command-line URL. - The expanded URL is captured by a local process monitor, audit facility, diagnostic tool, proxy, terminal recorder, or another logging component.
- An attacker with access to that record extracts the token.
- The attacker submits authenticated Apify API requests using the recovered token.
- The attacker can perform operations allowed by the token until it is revoked, expires, or reaches applicable a ...[truncated 618 chars]
- A user configures a valid
- Remediation
View remediation
Remediation Suggestions
-
Remove the
tokenquery parameter from all documented URLs. -
Send the credential in an authorization header supported by Apify:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms":["[NICHE] channel","[NICHE] YouTube"],"maxItems":100}'bash curl \ -H "Authorization: Bearer $APIFY_TOKEN" \ "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items" -
Ensure application and proxy logging redacts
Authorizationheaders and known secret values. -
Do not run credential-bearing commands with shell tracing such as
set -x; avoid verbose HTTP diagnostics in shared logs. -
Store the token in a protected secret manager or environment variable rather than source-controlled files. If
.envremains supported, require restrictive permissions and exclusion from version control. -
Use a narrowly scoped token where Apify supports scope restrictions, rotate it regularly, and revoke it immediately if URL-based commands have already been logged or shared.
-
Document the external data flow clearly so users understand that search parameters and retrieved YouTube research data are processed by Apify and the selected third-party actor.
-