T09 · Insecure Skill Coding Practices
- Location
SKILL.md:108- Finding
Apify API Token Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 108–120
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"twitterHandles": ["<handle>"], "maxItems": 200, "sort": "Latest"}'bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"'bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json"Technical Analysis
The documented REST workflow expands
APIFY_TOKENdirectly into three request URLs. Although the requests use HTTPS and target the expected Apify API, URL-based credentials can be recorded in shell history, process-command listings, API gateway or proxy logs, server access logs, monitoring platforms, debugging output, and copied error reports.This exposure is unnecessary because authentication can be carried in an HTTP authorization header. Therefore, the implementation does not follow least-privilege credential-handling practices even though the underlying network access is required for the Skill's declared tweet-scraping functionality.
No evidence was found that the token is deliberately transmitted to an unrelated endpoint or that the Skill performs malicious credential exfiltration.
Attack Path
- A user or Agent follows the documented REST fallback and executes one of the
curlcommands. - The shell expands
$APIFY_TOKENinto the URL passed as a command-line argument. - The resulting URL may be captured in shell history, process telemetry, proxy logs, server logs, diagnostics, or command output.
- A local user, telemetry operator, log reader, or other party with access to one of those records retrieves the token.
- The party reuses the token against Apify APIs.
- The attacker can perform ope ...[truncated 397 chars]
- A user or Agent follows the documented REST fallback and executes one of the
- Remediation
View remediation
Remediation Suggestions
- Remove
token=$APIFY_TOKENfrom every request URL. - Use Apify's supported authorization-header mechanism, such as:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"twitterHandles": ["<handle>"], "maxItems": 200, "sort": "Latest"}'- Apply the same header-based authentication to polling and dataset-retrieval requests.
- Use narrowly scoped, short-lived, and readily rotatable credentials where supported.
- Ensure commands, errors, and debug output redact authorization values.
- Review shell history, proxy logs, monitoring data, and CI logs for previously exposed tokens; rotate any token that may have been recorded.
- Inform users that account handles, search terms, and retrieved data are processed by the third-party Apify service.
- Remove