T09 · Insecure Skill Coding Practices
- Location
SKILL.md:84- Finding
Apify API Token Exposed Through URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 84
Vulnerability Type: API credential exposure through a URL query parameter
Risk Level: MediumVulnerable Code
bash curl -X POST "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{"keywords": ["#[brand]", "#[brand]review"], "maxItems": 100}'Technical Analysis
The documented REST fallback places
APIFY_TOKENin the request URL. When the shell expands the environment variable, the credential becomes part of both curl's process arguments and the outgoing request URI.Although HTTPS protects the request from passive network interception, it does not prevent credential disclosure through:
- Local process inspection while curl is running.
- HTTP access logs and request telemetry that record full URLs.
- Reverse-proxy, API gateway, monitoring, or diagnostic logs.
- Shell tracing, command-recording systems, or copied diagnostic output.
URLs are routinely retained and propagated more broadly than authorization headers. Using a reusable API token in a query parameter therefore unnecessarily increases its exposure.
Attack Path
- A user configures a valid
APIFY_TOKENand executes the documented REST fallback. - The shell expands
$APIFY_TOKENinto the command-line URL. - A local user with process-inspection access, or a logging and monitoring component that records request URIs, captures the full URL.
- The attacker extracts the reusable token from the
tokenquery parameter. - The attacker submits authenticated requests to Apify using the stolen token, subject to the token's assigned permissions and account controls.
Impact Assessment
Successful exploitation may permit unauthorized use of the victim's Apify account within the token's privilege scope. Potential consequences include running actors at the victim's expense, consuming account resources, and accessing data or actor functi ...[truncated 268 chars]
- Remediation
View remediation
Remediation Suggestions
Remove the token from the query string and transmit it in an authorization header:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"keywords":["#[brand]","#[brand]review"],"maxItems":100}'Additional hardening measures:
- Grant the token only the minimum permissions required for this actor workflow.
- Avoid enabling shell tracing or verbose HTTP diagnostics around commands that handle credentials.
- Redact authorization data from application, proxy, and monitoring logs.
- Store the token in a protected secret manager or environment configuration with restrictive access controls.
- Rotate any token previously used in URL form if relevant URLs may have been logged or exposed.
- Review Apify account activity and billing for unauthorized actor runs.