T09 · Insecure Skill Coding Practices
Error
- Location
index.js:194- Finding
Merchant API Key Exposed in Export URLs
- Content
View full analysis
{ const key = getApiKey(); if (!key) return { error: "No API key" }; return { export_url: `${API_BASE}/api/alliance-war/quests/${args.quest_id}/export?api_key=${key}` }; }, ``` ### Technical Analysis The export handlers place the long-lived merchant API key directly in the `api_key` URL query parameter. The resulting URL is then returned through CLI output or an MCP tool response. Query strings routinely propagate into locations that are not appropriate for secrets, including: - CLI output and terminal logs - MCP transcripts and host-application logs - Browser history and bookmarks - Reverse-proxy, CDN, and web-server access logs - Monitoring and analytics systems - Screenshots, copied messages, and support records - Potential HTTP `Referer` headers when navigating from the exported report The same codebase already supports authenticated requests through an `Authorization: Bearer` header. Therefore, placing the credential in a URL is not the minimum exposure necessary for the declared export functionality. The CLI variant also interpolates `flags.export` without URL encoding. Although this does not directly permit changing the fixed origin, the quest identifier should still be encoded consistently. ### Attack Path 1. A merchant or an AI agent invokes the quest export command or the `export_submissions` MCP tool. 2. The handler reads the merchant API key from the environment or local configuration. 3. T ...[truncated 1260 chars]- Remediation
View remediation