T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:39
- Finding
- Trello API Credentials Exposed Through URL Query Strings<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39, 45, 51, 57–60, 65–67, 72–74, 80–82, 94, 97, and 100 **Vulnerability Type**: Credentials exposed in command-line URLs **Risk Level**: Medium ### Vulnerable Code ```bash curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id}' curl -s "https://api.trello.com/1/boards/{boardId}/lists?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id}' curl -s "https://api.trello.com/1/lists/{listId}/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id, desc}' curl -s -X POST "https://api.trello.com/1/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "idList={listId}" \ -d "name=Card Title" \ -d "desc=Card description" curl -s -X PUT "https://api.trello.com/1/cards/{cardId}?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "idList={newListId}" curl -s -X POST "https://api.trello.com/1/cards/{cardId}/actions/comments?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "text=Your comment here" curl -s -X PUT "https://api.trello.com/1/cards/{cardId}?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "closed=true" curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN&fields=name,id" | jq curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | select(.name | contains("Work"))' curl -s "https://api.trello.com/1/boards/{boardId}/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, list: .idList}' ``` ### Technical Analysis Every documented request interpolates `TRELLO_API_KEY` and `TRELLO_TOKEN` directly into the request URL. After shell expansion, the complete URL—including the full-access token—becomes part of the `curl` process arguments. Depending on operating-system process visibility and host configuration, another local user or monitoring service may obtain these values from process listings, command teleme ...[truncated 2101 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Remove credentials from request URLs.** Use a Trello-supported authorization mechanism that does not place the token in the URL, such as the documented OAuth `Authorization` header. 2. **Do not place the replacement secret directly in command-line arguments.** Supplying an authorization header through `curl -H` may still expose it in process arguments. Load sensitive curl configuration through a permission-restricted file or standard input instead. 3. **Protect credential files.** If a temporary or persistent configuration file is required: - Create it with restrictive permissions such as `0600`. - Store it outside the project and other shared directories. - Exclude it from source control and backups where appropriate. - Delete temporary files immediately after use. - Avoid predictable temporary-file names. 4. **Reduce token privileges and lifetime.** Use the narrowest permissions supported for the required Trello operations, rotate tokens regularly, and revoke tokens immediately after suspected exposure. 5. **Harden logging.** Configure shell tracing, CI/CD systems, process telemetry, HTTP diagnostics, and centralized logging to redact Trello keys, tokens, `Authorization` values, and sensitive query parameters. 6. **Update all examples consistently.** Replace every affected example at lines 39–100 so users are not directed back to the insecure query-string pattern. 7. **Rotate credentials already used with these commands** if process records, shell traces, or URL logs may have captured them. ]]>