T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/browser.sh:25
- Finding
- TinyFish API Key Exposed Through Process Command-Line Arguments## Vulnerability Details **File Location**: `scripts/browser.sh`, lines 25-29 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ```bash exec curl -s -X POST "https://api.browser.tinyfish.ai" \ -H "X-API-Key: ${TINYFISH_API_KEY}" \ -H "Content-Type: application/json" \ -d "$BODY" ``` ### Technical Analysis The script expands `TINYFISH_API_KEY` directly into a command-line argument passed to `curl`. While the key is transmitted to the intended service over HTTPS, its presence in the local process argument list can expose it through process-inspection interfaces and monitoring tools. Depending on the operating system and process-isolation configuration, another local user or process may be able to retrieve the header from utilities such as `ps` or from process metadata such as `/proc/<pid>/cmdline`. Process auditing and telemetry systems may also record the complete command line, causing the credential to persist in logs after the request finishes. ### Attack Path 1. A victim invokes `scripts/browser.sh` while `TINYFISH_API_KEY` contains a valid credential. 2. The script starts `curl` with the complete `X-API-Key` header in its process arguments. 3. During the request, an attacker with sufficient local process-inspection access observes the `curl` command line. 4. The attacker extracts the TinyFish API key from the header argument. 5. The attacker submits requests directly to the TinyFish Browser API using the stolen credential. 6. The attacker can create unauthorized remote browser sessions within the permissions and usage limits assigned to that API key. Exploitation requires local process-observation capability or access to command-line telemetry collected by the host. The vulnerability does not independently provide remote code execution or elevated operating-system privileges. ### Impact Assessment Successful exploitation compromises the confid ...[truncated 521 chars]
- Remediation
- ## Remediation Suggestions Avoid placing the API key directly in `curl` command-line arguments. - Pass the sensitive header through a protected configuration file or file descriptor rather than through `-H` on the command line. - If a temporary configuration file is necessary, create it with restrictive permissions such as mode `0600`, store it in a trusted directory, and remove it reliably with a shell `trap`. - Prefer an anonymous pipe or another mechanism that does not persist the secret on disk. - Ensure process-monitoring and audit systems redact authorization headers and API keys. - Rotate the existing TinyFish API key if it may have been exposed through process inspection or logging. - Add `curl --fail-with-body` or equivalent status handling so HTTP failures are reported reliably. One possible hardening pattern is to provide a protected curl configuration over standard input: ```bash printf 'header = "X-API-Key: %s"\n' "$TINYFISH_API_KEY" | curl --fail-with-body --silent --show-error \ --config - \ -X POST "https://api.browser.tinyfish.ai" \ -H "Content-Type: application/json" \ -d "$BODY" ``` Before adopting this pattern, verify that the target platform does not expose pipe contents through its diagnostics or telemetry and that failures cannot echo the configuration containing the secret.