T09 · Insecure Skill Coding Practices
- Location
vintagepostergenerator.js:4- Finding
API Token Exposure Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
vintagepostergenerator.js:4-24; insecure usage is documented inSKILL.md:14-21andREADME.md:23-33
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: MediumVulnerable Code
javascript const args = process.argv.slice(2); // Parse CLI arguments let prompt = null; let size = 'portrait'; let tokenFlag = null; let refUuid = null; for (let i = 0; i < args.length; i++) { if (args[i] === '--token' && args[i + 1]) { tokenFlag = args[++i]; } else if (args[i] === '--size' && args[i + 1]) { size = args[++i]; } else if (args[i] === '--ref' && args[i + 1]) { refUuid = args[++i]; } else if (!args[i].startsWith('--') && prompt === null) { prompt = args[i]; } } const TOKEN = tokenFlag;The documentation explicitly instructs users to place the secret on the command line:
bash node vintagepostergenerator.js "your prompt" --token YOUR_TOKENTechnical Analysis
The program obtains the Neta API token directly from
process.argv. Command-line arguments are not an appropriate secret transport mechanism because the complete invocation may be retained in shell history, process-monitoring logs, terminal telemetry, debugging output, or operating-system process metadata.Exposure through process listings depends on the operating system and its process-isolation configuration. Nevertheless, shell-history retention alone creates a persistent plaintext copy in common environments. The implementation provides no safer alternative, such as a protected environment variable, standard-input prompt, or credential store.
The token is subsequently placed in the
x-tokenrequest header and therefore functions as an authentication credential for the remote service.Attack Path
- A user follows the documented example and invok ...[truncated 1258 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
--tokenas the recommended credential transport mechanism. - Read the token from a dedicated environment variable, such as
NETA_API_TOKEN, and clearly document how to set it without placing it directly in shell history. - For interactive use, accept the token through a hidden standard-input prompt that disables terminal echo.
- Where supported, integrate with an operating-system credential store or secret manager.
- Retain command-line token support only if backward compatibility is essential, and emit a prominent deprecation warning explaining the exposure risk.
- Avoid logging the token or including it in error messages. Ensure request-debugging and telemetry systems redact the
x-tokenheader. - Advise users who previously followed the documented command to remove affected history entries and rotate potentially exposed tokens.
A safer non-interactive pattern would be:
javascript const TOKEN = process.env.NETA_API_TOKEN; if (!TOKEN) { console.error('Token required. Set the NETA_API_TOKEN environment variable.'); process.exit(1); }Deployment documentation should recommend injecting this variable through a protected secret-management mechanism rather than committing it to a file.
- Remove