T09 · Insecure Skill Coding Practices
- Location
SKILL.md:93- Finding
Apify API Token Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 93–96
Vulnerability Type: Credential exposure through command-line arguments and URL query parameters
Risk Level: MediumVulnerable Code
bash # Twitter curl -X POST "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{"searchTerms": ["[BRAND_NAME]"], "maxItems": 300}' # Reddit curl -X POST "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{"searches": ["[BRAND_NAME]"], "maxItems": 200, "sort": "new", "time": "month"}'Technical Analysis
The documented REST fallback expands
APIFY_TOKENdirectly into each request URL. After shell expansion, the complete secret becomes part of thecurlprocess arguments. Depending on the operating-system configuration, other local users or monitoring software may be able to observe those arguments while the process is running.URL query parameters are also more likely than authorization headers to be retained by command histories, debugging output, proxies, gateways, observability systems, or HTTP request logs. Although HTTPS protects the URL in transit, it does not prevent exposure through local process inspection or logging at endpoints and intermediary infrastructure.
Attack Path
- A user follows the skill's REST fallback instructions with a valid
APIFY_TOKENin the environment. - The shell expands
$APIFY_TOKENand passes a URL containing the plaintext credential tocurl. - An attacker with local process-inspection access, or access to infrastructure that records complete request URLs, captures the token.
- The attacker reuses the token against Apify APIs.
- The attacker can perform actions allowed by the compromised token until it is revoked or expires.
Exploitation requires access to process metadata, logs, telemetry, or another location ...[truncated 547 chars]
- A user follows the skill's REST fallback instructions with a valid
- Remediation
View remediation
Remediation Suggestions
-
Transmit the token in an authorization header rather than a URL query parameter:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["[BRAND_NAME]"], "maxItems": 300}' -
Apply the same correction to every documented Apify request.
-
Ensure shell tracing is disabled when commands handle secrets, and never print the token in diagnostic output.
-
Configure proxies, gateways, and application logging to redact authorization data and other credentials.
-
Use a least-privilege token where Apify supports permission scoping.
-
Rotate any token suspected of having appeared in process captures, command output, or URL logs.
-
Store the token in an appropriately protected environment or secret-management facility rather than in project files or command history.
-