T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:111- Finding
Apify API Token Exposed in URL Query Strings
- Content
View full analysis
"], "maxItems": 200}' ``` Save `id` as `RUN_ID`. Poll until `status = SUCCEEDED`: ```bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"' ``` Fetch results: ```bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json" ``` ### Technical Analysis The documented REST workflow interpolates `APIFY_TOKEN` directly into three request URLs. Network access to Apify is necessary for the Skill's declared tweet-scraping functionality, but exposing the credential in a URL is not necessary. When these commands are executed, the expanded URLs may be observable in process arguments, shell history, terminal logging, proxy and gateway logs, monitoring platforms, debugging traces, or HTTP access logs. HTTPS protects the request in transit but does not prevent credential disclosure at these local or infrastructure-level observation points. This is an insecure credential-handling practice rather than evidence that the Skill intentionally sends data to an unrelated service. ### Attack Path 1. A user configures a valid `APIFY_TOKEN` and executes the documented `curl` commands. 2. The shell expands `$APIFY_TOKEN` inside each command-line URL. 3. The resulting URL is captured through shell history, process inspection, terminal recording, proxy logs, monitoring data, or service-side request logs. 4. An attacker with access to one of those records extracts the token. 5. The attacker submits authenticated requests to Apify using the exposed credential. 6. The attacker accesses resources or consumes services permitted by that token ...[truncated 710 chars]- Remediation
View remediation
"], "maxItems": 200}' ``` Apply the same header pattern to polling and dataset retrieval: ```bash curl \ -H "Authorization: Bearer $APIFY_TOKEN" \ "https://api.apify.com/v2/actor-runs/$RUN_ID" ``` ```bash curl \ -H "Authorization: Bearer $APIFY_TOKEN" \ "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?format=json" ``` 2. **Prevent accidental logging.** Do not print authorization headers, expanded environment variables, or complete authenticated requests in verbose output. Ensure CI, proxy, and application logs redact authorization values. 3. **Apply least privilege.** Use an Apify token restricted to only the actors, runs, and datasets required by this Skill, where supported. 4. **Rotate potentially exposed credentials.** Tokens previously used with the documented query-string commands should be revoked and replaced if URLs may have been retained in logs or shell history. 5. **Harden local secret storage.** Keep the token in a protected environment or secret manager. If a `.env` file is used, restrict its permissions and exclude it from version control. ]]>