T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:91- Finding
Apify API Token Exposed in URL Query Parameters
- Content
View full analysis
"], "maxComments": 200}' ``` Save `id` as `RUN_ID`. Poll until `status = SUCCEEDED`: ```bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | grep '"status"' ``` Fetch results: ```bash curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN&format=json" ``` ``` ### Technical Analysis The REST fallback embeds `APIFY_TOKEN` directly in the query string of three URLs. Network access to Apify is necessary for the declared YouTube-comment scraping functionality, and the requests use HTTPS. However, placing a reusable credential in a URL creates unnecessary exposure beyond the minimum privileges required. After shell expansion, the token becomes part of the `curl` command-line argument and full request URL. Query strings can consequently be captured by: - Local process inspection or process-accounting facilities. - Shell tracing and diagnostic output. - HTTP proxy, gateway, monitoring, and server access logs. - Error reports or copied command output. - Automation systems that record command lines or requested URLs. HTTPS protects the request from passive interception in transit but does not prevent credential disclosure through endpoints, process metadata, or logging infrastructure. Apify supports authorization headers, so exposing the token in the query string is not necessary. The documentation also accepts user-provided YouTube URLs and submits them to the expected Apify service. That transfer is consistent with the Skill's declared remote scraping functionality and is not, by itself, an unrelated e ...[truncated 1487 chars]- Remediation
View remediation
"], "maxComments": 200}' curl \ -H "Authorization: Bearer $APIFY_TOKEN" \ "https://api.apify.com/v2/actor-runs/$RUN_ID" curl \ -H "Authorization: Bearer $APIFY_TOKEN" \ "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?format=json" ``` 3. Use a narrowly scoped Apify token with only the permissions required to run the specified actor and retrieve its results. 4. Avoid shell tracing, verbose HTTP diagnostics, and logging of authorization headers. 5. Store the token in a protected environment variable or secret manager rather than command history or project files. 6. Redact credentials from application, proxy, CI/CD, and monitoring logs. 7. Rotate the token immediately if the query-string workflow has been used in an environment where URLs or process arguments may have been retained. 8. Add secret-scanning and documentation linting checks that reject credentials in URL query parameters. ]]>