T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:226
- Finding
- DataForSEO Basic Credential Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 226–233 **Vulnerability Type**: Plaintext credential exposure in process arguments **Risk Level**: Medium ### Vulnerable Code ```bash curl -s -X POST "https://api.dataforseo.com/v3/dataforseo_labs/google/keyword_overview/live" \ -H "Authorization: Basic $DATA_FOR_SEO_API_BASE64" -H "Content-Type: application/json" \ -d '[{"keywords":["<kw1>","<kw2>","..."],"location_code":2840,"language_code":"en"}]' ``` The environment variable is explicitly defined as a reusable credential: ```text The env value is `base64(login:password)` and is used verbatim as the HTTP Basic credential. ``` ### Technical Analysis The Skill instructs the agent to expand `DATA_FOR_SEO_API_BASE64` directly inside a `curl` command-line argument. The expanded `Authorization` header may consequently be visible to local process-inspection facilities, execution telemetry, shell tracing, command audit systems, or wrappers that log argument vectors. Base64 encoding provides no confidentiality: anyone who obtains the value can decode the underlying `login:password` pair or replay the Basic credential directly. The outbound request itself is necessary for the optional DataForSEO enrichment feature and targets the declared official API; the issue is the insecure credential-passing mechanism rather than unexplained network exfiltration. ### Attack Path 1. A user configures `DATA_FOR_SEO_API_BASE64` with valid DataForSEO credentials. 2. The Skill performs keyword enrichment and invokes the documented `curl` command. 3. The shell expands the variable into the `Authorization` argument before starting `curl`. 4. A local user, monitoring agent, command wrapper, audit service, or other process with sufficient process-inspection access captures the expanded argument while the request is running or from retained telemetry. 5. The observer extracts or replays the Basic credential. 6. The observer authenticates to DataForSEO as the victim ...[truncated 654 chars]
- Remediation
- ## Remediation Suggestions 1. Do not place the expanded `Authorization` header directly in command-line arguments. 2. Prefer a maintained API client that reads the credential from a protected environment variable internally without exposing it through the process argument vector. 3. If `curl` must be used, provide sensitive configuration through a permission-restricted temporary file or private standard-input mechanism, subject to platform support: - Create the file with owner-only permissions such as mode `0600`. - Avoid predictable file names and symlink-following behavior. - Delete the file immediately after use, including on errors or interruption. 4. Disable shell tracing around credential-bearing operations and ensure command wrappers, CI systems, and audit tooling redact `Authorization` headers and `DATA_FOR_SEO_API_BASE64`. 5. Prefer scoped, revocable API tokens over reusable username/password credentials if DataForSEO supports them. 6. Run the Skill under a dedicated low-privilege account and restrict access to process metadata and execution logs. 7. Rotate the DataForSEO credential if the current command has already been used in an environment where arguments or commands are retained.