T09 · Insecure Skill Coding Practices
- Location
SKILL.md:92- Finding
API Token Exposed in URL Query String
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 92
Vulnerability Type: Credential exposure through a URL query parameter
Risk Level: Mediumbash curl -X POST "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN" -H "Content-Type: application/json" -d '{"searchKeywords": ["personal finance tips", "best investing 2026", "investing for beginners"], "maxResults": 50}'Technical Analysis
The documented REST fallback places
APIFY_TOKENdirectly in the request URL. Although HTTPS encrypts the request in transit, URL query strings can be retained in shell history, command and process telemetry, debugging output, proxy or gateway access logs, monitoring systems, and other diagnostic records.This unnecessarily broadens the token's exposure compared with transmitting it in an authorization header. An attacker who can read any record containing the expanded command or request URL may recover and reuse the credential.
Attack Path
- A user follows the documented REST fallback with
APIFY_TOKENset in the environment. - The shell expands
$APIFY_TOKENinto the command's URL. - The full URL is captured by shell history, process monitoring, proxy logging, debugging, or observability infrastructure.
- An unauthorized party with access to that record extracts the token.
- The party submits authenticated requests to Apify within the permissions and lifetime of the compromised token.
Impact Assessment
A recovered token may allow unauthorized use of Apify resources available to that credential, including starting actor runs and potentially accessing related runs or datasets. The precise scope depends on the token's permissions and Apify account configuration. Abuse could expose accessible scraped data, consume quotas, or generate charges. This finding does not establish host privilege escalation or arbitrary local code execution.
- A user follows the documented REST fallback with
- Remediation
View remediation
Remediation Suggestions
- Authenticate through Apify's supported authorization header rather than a URL query parameter.
- Ensure examples do not print, log, or persist the token.
- Use a least-privilege token limited to the resources required by the skill.
- Prevent credential-bearing commands and headers from being captured in verbose logs or command traces.
- Store the token in an approved secret manager or protected environment variable, with restrictive access controls.
- Rotate any token that may already have appeared in shell history, logs, telemetry, or shared documentation.
- Add the referenced
scripts/run_actor.jsimplementation to the package if it is intended to be the recommended secure execution path, and subject its credential handling, input validation, output permissions, and logging behavior to a separate audit.