T09 · Insecure Skill Coding Practices
- Location
scripts/submit_hailuo_02.sh:4- Finding
Bearer API Key Exposed Through Process Arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/submit_hailuo_02.sh, lines 4–22
Vulnerability Type: API credential exposure through command-line arguments
Risk Level: MediumVulnerable Code
sh api_key="${POYO_API_KEY:-${1:-}}" if [ -z "$api_key" ]; then echo "Usage: submit_hailuo_02.sh [api_key] [payload.json]" >&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2 exit 1 fi payload="${2:-${1:+}}" if [ -n "${POYO_API_KEY:-}" ]; then payload="${1:-}" fi if [ -n "$payload" ] && [ "$payload" != "$api_key" ]; then body=$(cat "$payload") else body=$(cat) fi curl -sS https://api.poyo.ai/api/generate/submit \ -H "Authorization: Bearer $api_key" \ -H 'Content-Type: application/json' \ -d "$body"Technical Analysis
The script explicitly supports accepting the PoYo API key as its first positional argument. Secrets supplied this way can be recorded in shell history and exposed through process listings, command auditing, terminal logging, and process telemetry.
In addition, regardless of whether the key originates from a positional argument or
POYO_API_KEY, the script interpolates it into thecurlauthorization-header argument. This places the Bearer token in thecurlprocess argument vector while the request is running. On systems where another user, monitoring agent, or process has permission to inspect command lines, the token may be recovered.The request body is also supplied through
curl's-dargument. Although this is not necessarily sensitive in every use case, prompts, callback URLs, and other payload contents may consequently be visible through the same process-inspection channels.Attack Path
- A user invokes the script with the API key as its first argument or provides it through
POYO_API_KEY. - The script expands the secret into the
Authorization: Bearer ...argument used to launchcurl. - While `curl ...[truncated 1086 chars]
- A user invokes the script with the API key as its first argument or provides it through
- Remediation
View remediation
Remediation Suggestions
- Remove support for passing API keys as positional command-line arguments. Require
POYO_API_KEYor a protected credential source instead. - Avoid embedding the authorization value directly in
curl's command-line arguments. Provide sensitive headers through a temporary curl configuration file or another mechanism that does not expose them in the argument vector. - If a temporary configuration file is used:
- Create it with permissions restricted to the current user, such as mode
0600. - Use a securely created unpredictable path.
- Install an exit trap to delete it on normal completion, errors, and signals.
- Do not place it in a shared or predictably named location.
- Create it with permissions restricted to the current user, such as mode
- Pass the JSON body through standard input, for example with
--data-binary @-, rather than interpolating it into the command line. - Disable shell tracing around credential handling and document that users must not invoke the script with
set -x. - Redact authorization headers from process telemetry, debugging output, and audit logs where supported.
- Rotate any API key that may previously have been passed positionally or captured by command-line monitoring.
- Remove support for passing API keys as positional command-line arguments. Require