T09 · Insecure Skill Coding Practices
- Location
SKILL.md:90- Finding
Apify API Token Exposed in URL Query Parameter
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 90–93
Vulnerability Type: Credential exposure through a URL query parameter
Risk Level: MediumVulnerable Code
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"queries": ["\"[BRAND_NAME]\" news"], "maxPagesPerQuery": 3, "searchType": "news"}'Technical Analysis
The documented REST fallback expands
APIFY_TOKENdirectly into the request URL. Although the request uses HTTPS and the destination is the declared Apify API, secrets embedded in URLs can be exposed outside the encrypted network channel.The expanded URL may be visible in process command-line information, host monitoring systems, shell debugging output, proxy telemetry, API access logs, error reports, or copied diagnostics. Any component that records the full request URL may therefore retain a reusable credential.
The network request itself is necessary for the Skill's Google News monitoring function, and no evidence indicates that the token is sent to an unrelated or malicious destination. The vulnerability is specifically the unsafe credential transport mechanism.
Attack Path
- A user configures a valid
APIFY_TOKENand executes the documented REST fallback. - The shell expands
$APIFY_TOKENinto curl's URL argument. - A local process observer, telemetry agent, proxy, or logging system captures the command line or complete request URL.
- An attacker with access to that captured information extracts the token.
- The attacker submits authenticated requests to Apify using the stolen token.
- The attacker can perform actions allowed by the token until it expires or is revoked.
Impact Assessment
Successful exploitation grants the attacker the same Apify API permissions assigned to the exposed token. Depending on its scope, this could allow unaut ...[truncated 363 chars]
- A user configures a valid
- Remediation
View remediation
Remediation Suggestions
Remove the token from the request URL and transmit it through an authorization header:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"queries": ["\"[BRAND_NAME]\" news"], "maxPagesPerQuery": 3, "searchType": "news"}'Apply the following additional controls:
- Use a dedicated, least-privilege Apify token with only the permissions required to run the specified actor and retrieve its results.
- Avoid verbose shell tracing, curl trace output, or debug logging that could record authorization headers.
- Redact credentials from process telemetry, proxy logs, error reports, and command transcripts.
- Store the token in a protected secret manager or restricted environment rather than committing it to files.
- Rotate any token previously used in the query parameter if relevant URLs or command lines may have been retained.
- Configure token expiration, usage monitoring, and account spending limits where supported.