T09 · Insecure Skill Coding Practices
- Location
SKILL.md:83- Finding
Apify API Token Exposed Through URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 83–94
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tiktok-user-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"username": "<handle>", "maxVideos": 50}'bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"'bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"Technical Analysis
The documented REST workflow places
APIFY_TOKENdirectly in URL query strings. Although authentication with Apify is necessary for the Skill's declared scraping functionality, transmitting the credential as part of a command-line URL unnecessarily broadens its exposure.The shell expands
$APIFY_TOKENbefore launchingcurl, potentially making the credential visible in process arguments. Query strings may also be retained by shell tracing, command auditing, terminal capture, monitoring products, HTTP proxy logs, server access logs, and copied troubleshooting output. TLS protects the request in transit but does not prevent disclosure through these local or endpoint logging channels.The network destination is consistent with the declared functionality, and there is no evidence that the Skill deliberately sends the token to an unrelated service. The vulnerability is the unsafe authentication mechanism rather than the required network access itself.
Attack Path
- A user sets a valid
APIFY_TOKENand follows the documented REST fallback. - The shell expands the environment variable into the
curlURL. - A local process observer, command-auditing system, shell trace, proxy, server log, or diagnostic capture records the complete URL.
- An attacker with access to that record ...[truncated 553 chars]
- A user sets a valid
- Remediation
View remediation
Remediation Suggestions
-
Remove authentication tokens from all URL query parameters.
-
Pass the credential through an authorization header supported by Apify, for example:
bash curl \ -H "Authorization: Bearer $APIFY_TOKEN" \ "https://api.apify.com/v2/actor-runs/$RUN_ID" -
Apply the same header-based authentication approach to actor launch, status polling, and dataset retrieval requests.
-
Disable shell tracing around commands that handle credentials and avoid printing complete request headers or URLs in diagnostics.
-
Use narrowly scoped tokens where the platform supports them.
-
Rotate the token immediately if it may already have appeared in process telemetry, proxy logs, command logs, or shared troubleshooting output.
-
Ensure monitoring and logging systems redact authorization credentials.
-
Document that retrieved TikTok data is sent to and processed by the third-party Apify actor, especially when optional follower or following collection is enabled.
-