T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:48
- Finding
- Bearer Token Exposed Through Curl Process Arguments## Vulnerability Details **File Location**: `SKILL.md:48-59`; `references/requests.md:6-8` **Vulnerability Type**: Exposure of authentication credentials through command-line arguments **Risk Level**: Medium ### Vulnerable Code `SKILL.md:48-59`: ```sh LS=$(fpx local-storage auth tokenExpiry -p ofw) TOKEN=$(jq -r '.auth' <<<"$LS") EXPIRES=$(jq -r '.tokenExpiry' <<<"$LS") ``` ```sh curl -s 'https://ofw.ourfamilywizard.com/pub/v2/profiles' \ -H "Authorization: Bearer $TOKEN" \ -H 'ofw-client: WebApplication' \ -H 'ofw-version: 1.0.0' \ | jq . ``` `references/requests.md:6-8`: ```sh AUTH_HEADERS=(-H "Authorization: Bearer $TOKEN" -H 'ofw-client: WebApplication' -H 'ofw-version: 1.0.0') ``` ### Technical Analysis The Skill extracts the authenticated OurFamilyWizard bearer token from browser local storage and expands it directly into a `curl` command-line argument. Shell variable expansion causes the complete `Authorization` header, including the live bearer token, to become part of the `curl` process argument vector. Depending on operating-system process visibility and host configuration, command-line arguments can be observed through process inspection interfaces or local monitoring and diagnostic tools. Shell tracing, terminal logging, or wrappers around `curl` can also capture the expanded argument. The token transfer to the declared HTTPS API is necessary for the Skill's functionality. The vulnerability is not the network destination itself, but the unnecessary exposure of the credential through a process argument while performing that transfer. ### Attack Path 1. The victim captures an authenticated OFW token into the `TOKEN` shell variable. 2. The victim runs one of the documented `curl` commands. 3. The shell expands `"Authorization: Bearer $TOKEN"` before starting `curl`. 4. A local process observer, monitoring tool, malicious wrapper, or command-logging facility ...[truncated 1183 chars]
- Remediation
- ## Remediation Suggestions - Do not place the bearer token directly in a process command-line argument. - Provide the authorization header through a protected input mechanism that does not expose the token in the process argument vector. - One option is to generate a temporary curl configuration file with permissions set to `0600`, pass the configuration file to `curl`, and securely remove it immediately afterward. - Prefer an anonymous temporary file descriptor or standard-input-based configuration where supported, reducing the time the credential exists on disk. - Disable shell tracing with `set +x` before token capture and API invocation, and warn users not to run these commands under verbose shell tracing. - Avoid printing the token, the expanded header array, or commands containing the token in logs and error messages. - Clear sensitive shell variables after use, for example with `unset TOKEN LS AUTH_HEADERS`. - Document token revocation or invalidation procedures so users can respond promptly to suspected disclosure. - Consider replacing the shell workflow with a small reviewed client that stores the token in memory and sets the HTTP authorization header without exposing it through command-line arguments.