T09 · Insecure Skill Coding Practices
- Location
SKILL.md:84- Finding
Apify API Token Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 84–97
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tiktok-comments-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"videoUrls": ["<url>"], "maxItems": 200}'bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"'bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"Technical Analysis
The documented REST workflow embeds
APIFY_TOKENin request URL query strings. The credential is sent to the intended Apify domain over HTTPS, and authentication is necessary for the declared scraping functionality. However, placing a secret in a URL creates unnecessary exposure because URLs are commonly captured in shell history, process listings, terminal recordings, proxy and access logs, monitoring platforms, and copied diagnostic output.This behavior exceeds minimum necessary credential exposure because Apify API authentication can be performed with an HTTP authorization header. HTTPS protects the request while in transit but does not prevent disclosure through local process inspection, command logging, endpoint monitoring, or server-side URL logging.
Attack Path
- A user exports a valid
APIFY_TOKENand runs one of the documentedcurlcommands. - The shell expands
$APIFY_TOKENinto the command-line URL. - A local user, process-monitoring tool, shell recorder, proxy, logging system, or diagnostic collector captures the expanded command or requested URL.
- An attacker obtains the captured token.
- The attacker reuses it against the Apify API within the token's assigned permissions.
- The attacker may consume account resources or access actor runs and datasets available to that token until it is revoked or e ...[truncated 641 chars]
- A user exports a valid
- Remediation
View remediation
Remediation Suggestions
Use Apify's authorization header instead of placing the token in the URL:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tiktok-comments-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"videoUrls": ["<url>"], "maxItems": 200}'Apply the same header-based authentication to polling and dataset retrieval:
bash curl \ -H "Authorization: Bearer $APIFY_TOKEN" \ "https://api.apify.com/v2/actor-runs/$RUN_ID"bash curl \ -H "Authorization: Bearer $APIFY_TOKEN" \ "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?format=json"Additional hardening measures:
- Issue a dedicated, least-privilege Apify token for this Skill.
- Store the token in an approved secret manager or protected environment variable rather than source files.
- Avoid verbose command tracing, such as
set -x, while handling credentials. - Ensure logs and diagnostics redact authorization headers and secret values.
- Rotate any token that may already have appeared in command history, process telemetry, logs, or shared terminal output.
- Document token revocation and incident-response procedures.