T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:233
- Finding
- Steam API Key Exposed in Command-Line URLs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:233-304` **Vulnerability Type**: Sensitive credential exposure through command-line arguments and URL query parameters **Risk Level**: Medium ### Vulnerable Code ```bash # SKILL.md:233-234 curl -s "https://api.steampowered.com/IEconService/GetTradeOffers/v1/?key=$STEAM_API_KEY&get_sent_offers=1&get_received_offers=1&active_only=1&get_descriptions=1&language=english" \ | jq '.' ``` ```bash # SKILL.md:239-240 curl -s "https://api.steampowered.com/IEconService/GetTradeOffers/v1/?key=$STEAM_API_KEY&get_sent_offers=0&get_received_offers=1&active_only=1&get_descriptions=1&language=english" \ | jq '.response.trade_offers_received' ``` ```bash # SKILL.md:245-246 curl -s "https://api.steampowered.com/IEconService/GetTradeOffers/v1/?key=$STEAM_API_KEY&get_sent_offers=1&get_received_offers=0&active_only=1&get_descriptions=1&language=english" \ | jq '.response.trade_offers_sent' ``` ```bash # SKILL.md:252-253 curl -s "https://api.steampowered.com/IEconService/GetTradeOffer/v1/?key=$STEAM_API_KEY&tradeofferid=$TRADE_OFFER_ID&language=english&get_descriptions=1" \ | jq '.response.offer' ``` ```bash # SKILL.md:259-260 curl -s "https://api.steampowered.com/IEconService/GetTradeOffersSummary/v1/?key=$STEAM_API_KEY&time_last_visit=0" \ | jq '.response' ``` ```bash # SKILL.md:304-305 curl -s "https://api.steampowered.com/IEconService/GetTradeHistory/v1/?key=$STEAM_API_KEY&max_trades=10&get_descriptions=1&language=english&include_failed=0" \ | jq '.response.trades' ``` ### Technical Analysis The Skill interpolates `STEAM_API_KEY` directly into URLs passed to `curl`. After shell expansion, the complete API key becomes part of the `curl` process arguments. Depending on the operating system and execution environment, command-line arguments may be visible through process inspection utilities, diagnostic tooling, audit systems, telemetry collectors, or error reports. Embedding credentials in URLs al ...[truncated 2113 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Avoid placing API keys directly in URLs supplied as command-line arguments. 2. Use a wrapper that supplies secret-bearing request configuration through standard input or another protected channel so the expanded key is not exposed in the process argument list. 3. If a Steam endpoint supports a non-URL authorization mechanism, use that mechanism instead of a query-string credential. 4. Ensure debugging, verbose HTTP logging, shell tracing, and command recording are disabled around credential-bearing requests. 5. Redact `key` query parameters in proxy logs, application telemetry, audit records, and error reports. 6. Run the Skill under a dedicated, least-privileged local account so unrelated users and processes cannot inspect its environment or process metadata. 7. Clearly document that users should rotate their Steam API key after suspected process, log, or telemetry exposure. 8. Prefer narrowly scoped or short-lived credentials if Steam makes such credential types available. ]]>