T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:66
- Finding
- Secrets Are Exposed Through Process Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md:66-69`; `references/env-injection-examples.md:13-16, 41-43, 52-56, 86-91` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium **Category**: T09: Insecure Skill Coding Practices ### Vulnerable Code `SKILL.md:66-69`: ```bash MY_SERVICE_API_KEY="$MY_SERVICE_API_KEY" curl -s \ -H "Authorization: Bearer $MY_SERVICE_API_KEY" \ https://api.myservice.com/v1/data ``` `references/env-injection-examples.md:13-16`: ```bash curl -s https://api.openai.com/v1/chat/completions \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model":"gpt-4o","messages":[{"role":"user","content":"Hello"}]}' ``` `references/env-injection-examples.md:41-43`: ```bash curl -s https://api.stripe.com/v1/customers \ -u "$STRIPE_SECRET_KEY:" ``` `references/env-injection-examples.md:52-56`: ```bash curl -s -X POST https://slack.com/api/chat.postMessage \ -H "Authorization: Bearer $SLACK_BOT_TOKEN" \ -H "Content-Type: application/json" \ -d "{\"channel\":\"#general\",\"text\":\"Hello\"}" ``` `references/env-injection-examples.md:86-91`: ```bash curl -s -X POST "https://api.twilio.com/2010-04-01/Accounts/$TWILIO_ACCOUNT_SID/Messages.json" \ --data-urlencode "From=+15551234567" \ --data-urlencode "To=+15559876543" \ --data-urlencode "Body=Hello" \ -u "$TWILIO_ACCOUNT_SID:$TWILIO_AUTH_TOKEN" ``` ### Technical Analysis The shell expands the referenced environment variables before starting `curl`. Consequently, bearer tokens, API keys, and basic-auth credentials become literal values in the `curl` process argument vector. Environment injection prevents credentials from being hardcoded in Skill text, but it does not make secrets safe when they are subsequently interpolated into command-line options such as `-H` or `-u`. Depending on operating-sy ...[truncated 2373 chars]
- Remediation
- ## Remediation Suggestions 1. Do not present `curl -H "Authorization: Bearer $TOKEN"` or `curl -u "$SECRET:"` as fully secret-safe. Explicitly document that shell expansion places these values in process arguments. 2. Prefer service clients or application code that reads credentials directly from inherited environment variables and constructs authorization headers internally. 3. Where a supported official CLI automatically reads a documented environment variable, use that mechanism rather than passing the credential as an option. 4. If `curl` is unavoidable, provide an operating-system-appropriate pattern that supplies sensitive configuration through a protected file descriptor or another non-argument input channel. Avoid persistent temporary credential files; if a temporary file is indispensable, create it with mode `0600`, prevent logging, and delete it reliably with a cleanup trap. 5. Run commands under a dedicated least-privileged account and restrict process inspection, telemetry collection, and access to diagnostic logs. 6. Use narrowly scoped, short-lived credentials and rotate any credential suspected of appearing in command-line telemetry. 7. Revise the comments in `SKILL.md` so they distinguish protection from LLM-context disclosure from protection against local host-level process observation.