T09 · Insecure Skill Coding Practices
- Location
comicpanelgenerator.js:5- Finding
API Token Exposed Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
comicpanelgenerator.js:5-18; insecure usage is documented inSKILL.md:15-19andREADME.md:27-31
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: MediumVulnerable Code
javascript const args = process.argv.slice(2); let prompt = null; let size = "portrait"; let tokenFlag = null; let refUUID = null; for (let i = 0; i < args.length; i++) { if (args[i] === "--size" && args[i + 1]) { size = args[++i]; } else if (args[i] === "--token" && args[i + 1]) { tokenFlag = args[++i]; } else if (args[i] === "--ref" && args[i + 1]) { refUUID = args[++i]; } else if (!args[i].startsWith("--") && prompt === null) { prompt = args[i]; } }The documentation explicitly instructs users to place the credential in the command line:
bash node comicpanelgenerator.js "your description here" --token YOUR_TOKENTechnical Analysis
The application obtains the Neta API token directly from
process.argv. Command-line arguments are not an appropriate secret-transport mechanism because they can be exposed through shell command history, terminal logging, process-monitoring utilities, debugging tools, job runners, and process metadata available to authorized local users or processes.The token is subsequently used as the
x-tokenauthentication header for requests to the declared API. It is not hardcoded or printed by the script, and the reviewed code does not deliberately exfiltrate it to an unrelated endpoint. The issue is the local exposure caused by the documented credential-input mechanism.Attack Path
- A user follows the documented command and supplies a valid token with
--token. - The shell may save the complete command, including the token, in its history.
- While the process is running, a local process with sufficient same-user ...[truncated 755 chars]
- A user follows the documented command and supplies a valid token with
- Remediation
View remediation
Remediation Suggestions
-
Prefer a protected environment variable such as
NETA_TOKENinstead of a command-line flag. -
Optionally support reading the token from standard input or an interactive hidden prompt.
-
If
--tokenmust remain for compatibility, mark it as deprecated and display a warning explaining that process arguments may be observable. -
Update all usage examples so they do not place the expanded secret in the command line. For example:
bash export NETA_TOKEN="..." node comicpanelgenerator.js "your description" -
Load and validate the environment variable without logging its value:
javascript const TOKEN = process.env.NETA_TOKEN; if (!TOKEN) { console.error("Token required. Set the NETA_TOKEN environment variable."); process.exit(1); } -
Ensure CI systems and wrappers mask the variable and do not emit it in diagnostic output.
-
Recommend rotating any token that has previously been entered literally into a shared or logged shell.
-