T09 · Insecure Skill Coding Practices
Warning
- Location
- summarize.sh:35
- Finding
- Anthropic API Key Exposed Through Process Arguments## Vulnerability Details **File Location**: `summarize.sh`, lines 35–47 **Vulnerability Type**: Secret exposure through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```bash RESPONSE=$(curl -s https://api.anthropic.com/v1/messages \ -H "content-type: application/json" \ -H "x-api-key: $ANTHROPIC_API_KEY" \ -H "anthropic-version: 2023-06-01" \ -d "{ \"model\": \"claude-sonnet-4-20250514\", \"max_tokens\": 1500, \"messages\": [{ \"role\": \"user\", \"content\": $FULL_CONTENT }] }" 2>/dev/null) ``` ### Technical Analysis The `ANTHROPIC_API_KEY` environment variable is expanded into curl's `-H` command-line argument. Consequently, the complete `x-api-key` header can appear in curl's process argument vector while the request is in progress. On systems where process arguments are visible to other users or processes through tools such as `ps` or interfaces such as `/proc/<pid>/cmdline`, a local attacker may observe and recover the credential. Exploitation depends on the operating system's process-isolation configuration, the attacker's local access, and their ability to inspect the process during the relatively short request window. This is an insecure secret-handling practice rather than evidence of intentional credential theft. The credential is sent only to the documented Anthropic API endpoint, which is necessary for the declared API-backed summarization functionality. ### Attack Path 1. A victim configures `ANTHROPIC_API_KEY` and invokes `summarize.sh`. 2. The script expands the credential into the `x-api-key` curl header argument. 3. While curl is running, a local attacker repeatedly monitors process argument vectors. 4. If process arguments are visible under the host's access-control policy, the attacker extracts the API key from the header argument. 5. The attacker reuses the key to submit unauthorized requests to the Anthropic API unt ...[truncated 513 chars]
- Remediation
- ## Remediation Suggestions - Do not place authentication secrets directly in command-line arguments. - Provide the sensitive header through a permission-restricted curl configuration supplied by a protected file descriptor or temporary file, where supported. - If a temporary file is unavoidable, create it with permissions limited to the current user, install an `EXIT` trap before writing the secret, and remove the file on every exit path. - Run the Skill under a dedicated, least-privileged account and configure the host to restrict cross-user process inspection. - Use a dedicated API key with minimum required permissions, provider-side spending limits, monitoring, and regular rotation. - Revoke and replace the key immediately if process monitoring or logs may have captured it. - Explicitly document that meeting transcripts are transmitted to `https://api.anthropic.com/v1/messages`, because transcripts may contain confidential business or personal information.