T09 · Insecure Skill Coding Practices
- Location
SKILL.md:101- Finding
Apify API Token Exposed in Request URL
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 101–105
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: Mediumbash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json"Technical Analysis
The documented REST fallback passes
APIFY_TOKENthrough the request URL's query string. When the shell expands the environment variable, the resulting secret becomes part of curl's command-line arguments and the complete request URL.Although HTTPS encrypts the request while it is in transit, it does not prevent exposure through local process inspection or URL recording by the API provider, reverse proxies, gateways, monitoring systems, and diagnostic logs. Authentication is necessary for the Skill's declared functionality, but placing the credential in a URL exceeds what is required; Apify authentication can instead be supplied through an HTTP authorization header.
Attack Path
- A user configures
APIFY_TOKENand executes the documented REST fallback. - The shell expands
$APIFY_TOKENdirectly into the curl request URL. - A local user capable of inspecting process arguments, or an infrastructure component that records request URLs, captures the expanded URL.
- The observer extracts the token from the
tokenquery parameter. - The exposed token is reused against Apify APIs within the permissions assigned to that token.
Impact Assessment
An attacker who obtains the token may perform unauthorized Apify API operations permitted by its scope. This could consume account credits, initiate actor runs, or expose run and dataset information accessible to the token. The precise impact is limited by the token's configured permissions and the affected Apify account's resources; the finding does not establish broader local-system compromise.
- A user configures
- Remediation
View remediation
Remediation Suggestions
Remove the token from the URL and transmit it through an HTTP authorization header:
bash curl -X POST \ "https://api.apify.com/v2/acts/apidojo~google-search-scraper/runs" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "queries": ["[keyword1]", "[keyword2]"], "maxPagesPerQuery": 2, "countryCode": "US", "languageCode": "en" }'In addition:
- Use an Apify token restricted to the minimum permissions required to run the designated actor and retrieve its results.
- Avoid printing, logging, or persisting the token in command output, generated reports, shell tracing, or debug logs.
- Review URL, proxy, gateway, and API access logs for prior token exposure if the documented command has already been used.
- Revoke and rotate any token that may have been recorded.
- Ensure any helper implementation, including the referenced but absent
scripts/run_actor.js, uses header-based authentication and does not expose secrets in command-line arguments or output files.