T09 · Insecure Skill Coding Practices
- Location
SKILL.md:99- Finding
Apify API Token Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 99-108
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["[NICHE]", "#[niche]trending", "[NICHE] breaking"], "maxItems": 100}'Wait for
SUCCEEDED. Fetch dataset:bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"Technical Analysis
The documented REST fallback places
APIFY_TOKENin the query string of two HTTPS URLs. Authentication is necessary for the Skill's declared remote scraping functionality, but placing the credential in a URL is not necessary and does not follow least-disclosure practices.Although HTTPS protects the URL while it is in transit, URLs can still be captured by process inspection, HTTP client diagnostics, reverse proxies, monitoring systems, application telemetry, and server access logs. Such records frequently receive broader access and longer retention than dedicated secret stores. The literal shell command may also be copied into scripts, support records, or execution logs after variable expansion.
The Skill does not intentionally send the token to an unrelated domain: both requests target Apify. The vulnerability is the insecure credential transport mechanism rather than unauthorized third-party exfiltration.
Attack Path
- A user configures a valid
APIFY_TOKENand follows the documented REST fallback. - The shell expands the token into the request URL.
- The complete URL is exposed to a process monitor, diagnostic trace, proxy, telemetry collector, or Apify-side access log.
- An attacker or unauthorized operator with access to one of those records extracts the token.
- The attacker submits authenticated requests to the ...[truncated 843 chars]
- A user configures a valid
- Remediation
View remediation
Remediation Suggestions
-
Remove the token from every URL and transmit it through an HTTP authorization header supported by Apify:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["[NICHE]", "#[niche]trending", "[NICHE] breaking"], "maxItems": 100}'bash curl \ "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items" \ -H "Authorization: Bearer $APIFY_TOKEN" -
Ensure execution wrappers redact authorization headers and environment variables from debug output, errors, and telemetry.
-
Avoid shell tracing such as
set -xwhile handling credentials. -
Store the token in a restricted secret manager or protected environment configuration rather than plaintext project files.
-
Use a narrowly scoped token with only the permissions required to invoke the designated actor and retrieve its output.
-
Rotate any token previously used in URL query strings if those requests may have entered logs, proxy records, or diagnostic systems.
-
Configure log retention and redaction controls to remove historical
tokenquery parameters.
-