T09 · Insecure Skill Coding Practices
- Location
tokenview_api.py:62- Finding
Tokenview API Key Disclosure Through Unsanitized Network Errors
- Content
View full analysis
Vulnerability Details
File Location:
tokenview_api.py, lines 62–80
Vulnerability Type: API credential exposure through query-string construction and unsanitized exception output
Risk Level: MediumVulnerable Code
python url = f"{BASE_URL}/{coin}/{address}?apikey={api_key}" try: resp = requests.get(url, timeout=10) resp.raise_for_status()python except requests.exceptions.RequestException as e: print(json.dumps({"code": -3, "msg": f"Network error: {e}", "data": "NONE"})) sys.exit(1)Technical Analysis
The Tokenview API key is embedded directly in the request URL as the
apikeyquery parameter. URLs are commonly included in HTTP client exceptions, diagnostic output, proxy logs, monitoring systems, and request histories.In particular,
requests.Response.raise_for_status()can raise anHTTPErrorwhose string representation contains the complete request URL. The handler catches that exception and copies its unsanitized string representation directly into JSON printed to standard output. Consequently, the value ofTOKENVIEW_API_KEYmay be returned to the invoking agent, displayed to a user, or retained in execution and conversation logs.Sending the API key and requested blockchain address to the documented Tokenview HTTPS endpoint is consistent with the Skill's declared balance-query functionality. The security issue is not the required network request itself, but the unnecessary propagation of a secret-bearing URL into externally visible error output.
Attack Path
- The Skill obtains
TOKENVIEW_API_KEYfrom the environment. - It constructs a URL containing the credential in the query string.
- A submitted query or a Tokenview-side condition results in a non-success HTTP status.
resp.raise_for_status()raises arequests.exceptions.HTTPError.- The exception string can contain the full URL, including
?apikey=.... - The exception ...[truncated 844 chars]
- The Skill obtains
- Remediation
View remediation
Remediation Suggestions
- Do not return raw
requestsexception text to users or agent-visible output. Replace it with a fixed message and, where useful, a non-sensitive HTTP status code. - If Tokenview supports an authorization header, transmit the API key in that header rather than in the URL.
- If the API contract requires a query parameter, redact
apikeyfrom every URL before logging or displaying it. - Separate internal diagnostics from user-facing errors. Internal logs should also apply structured secret redaction and restrictive access controls.
- Avoid logging response request objects, prepared URLs, or tracebacks unless a redaction filter is active.
- Rotate the current Tokenview API key if the vulnerable implementation has already been used and its output may have been retained.
A hardened error handler could use the following pattern:
python except requests.exceptions.HTTPError as e: status = e.response.status_code if e.response is not None else "unknown" print(json.dumps({ "code": -3, "msg": f"Tokenview request failed with HTTP status {status}", "data": "NONE" })) sys.exit(1) except requests.exceptions.RequestException: print(json.dumps({ "code": -3, "msg": "Tokenview network request failed", "data": "NONE" })) sys.exit(1)- Do not return raw