T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:16- Finding
API Key Exposure Through Command-Line Arguments
- Content
View full analysis
# Check region: mmx config show ``` ### Technical Analysis The authentication example instructs users to provide the MiniMax API key directly through the `--api-key` command-line argument. Secrets passed this way may be exposed in: - Shell history files - Process listings or process-monitoring tools while the command is running - Terminal session recordings - Command execution telemetry and audit logs - CI/CD job logs or wrapper-script diagnostics Although the example uses a placeholder rather than a hardcoded credential, users following the instruction are expected to replace it with a real API key. The document does not provide or recommend a safer mechanism such as an interactive hidden prompt, standard input, or a protected credential store. ### Attack Path 1. A user follows the documented authentication procedure and replaces `` with a valid MiniMax API key. 2. The shell records the complete command in its history, or the command is captured by process monitoring, terminal logging, or CI telemetry. 3. A local user, monitoring service, log reader, or attacker with access to those records retrieves the exposed key. 4. The attacker authenticates to MiniMax using the recovered credential. 5. The attacker invokes services permitted by the key, potentially consuming account quota or accessing resources associated with the affected account. Exploitation requires access to process metadata, shell history, terminal records, or execution logs containing the command. ### Impact Assessment A recovered key may allow unauthorized use of the MiniMax account and the text, image, video, speech, music, vision, or search capabilities authorized for that credenti ...[truncated 331 chars]- Remediation
View remediation