T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:90
- Finding
- Credentials Exposed Through Command-Line Arguments and URL Query Parameters## Vulnerability Details **File Location**: `SKILL.md:90`, `SKILL.md:101`, and `SKILL.md:142` **Vulnerability Type**: Insecure credential handling **Risk Level**: Medium ### Vulnerable Code ```bash # Basic auth curl -u username:password https://api.example.com ``` ```bash # API key in URL curl "https://api.example.com?api_key=your_key" ``` ```bash # With proxy authentication curl -x http://proxy:8080 -U user:pass https://api.example.com ``` ### Technical Analysis These examples encourage users to place account passwords, proxy credentials, and API keys directly in command-line arguments or URL query strings. Command-line secrets may be retained in shell history and can be exposed through process inspection, terminal logging, command auditing, or diagnostic tooling. API keys embedded in query strings can additionally appear in server and proxy access logs, monitoring platforms, copied URLs, and other systems that record request targets. The values shown are placeholders, and the file does not itself contain real credentials. The vulnerability arises when users replace those placeholders with production secrets and execute the documented commands. ### Attack Path 1. A user copies one of the documented commands. 2. The user replaces the placeholder with a valid password, proxy credential, or API key. 3. The command is executed and recorded in shell history, process telemetry, audit logs, or terminal logs. 4. For URL-based API keys, intermediate proxies, web servers, and monitoring systems may also record the complete URL. 5. An attacker or unauthorized operator with access to one of these records extracts the credential. 6. The attacker reuses the exposed credential against the relevant API, user account, or proxy service. ### Impact Assessment Successful exploitation can grant the attacker the same effective permissions as the exposed credential. Depending on the credential, this may include aut ...[truncated 399 chars]
- Remediation
- ## Remediation Suggestions - Do not recommend embedding passwords or tokens literally in command-line arguments. - Remove the API-key-in-URL example and recommend an authorization header or another provider-supported protected credential mechanism. - For Basic authentication, allow curl to prompt for the password by specifying only the username, where appropriate. - Consider a protected curl configuration file or `--netrc-file` with filesystem permissions restricted to the owning user. - If environment variables are demonstrated, warn users that careless shell expansion, debugging, and process-launch patterns can still expose their values. - Add an explicit warning that secrets may be retained in shell history, process telemetry, URLs, and service logs. - Recommend short-lived, narrowly scoped credentials and immediate rotation if a secret is accidentally exposed.