T09 · Insecure Skill Coding Practices
- Location
scripts/submit_kling_3_0.sh:12- Finding
PoYo API Key Exposed Through Process Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/submit_kling_3_0.sh, lines 12–15
Vulnerability Type: API credential exposure through process arguments
Risk Level: Mediumbash curl --fail-with-body --request POST \ --url "https://api.poyo.ai/api/generate/submit" \ --header "Authorization: Bearer ${POYO_API_KEY}" \Technical Analysis
The shell expands
${POYO_API_KEY}before startingcurl, placing the complete bearer credential in the process argument vector. Depending on operating-system process visibility and monitoring configuration, command-line arguments may be exposed through process inspection interfaces, diagnostic tools, audit systems, or process telemetry.This implementation also contradicts the explicit security requirement in
SKILL.mdthat API keys must not be passed as command-line arguments. Quoting the variable prevents shell word splitting but does not prevent credential exposure in the spawned process's arguments.Attack Path
- A user exports a valid
POYO_API_KEYand invokesscripts/submit_kling_3_0.shwith a payload. - The script expands the environment variable into the
--headerargument passed tocurl. - While
curlis running, a local actor or monitoring component with permission to inspect that process reads its command-line arguments. - The actor extracts the bearer token from the
Authorizationheader. - The stolen token is used to submit unauthorized requests to the PoYo API until it is revoked or expires.
Exploitation requires local process-inspection access or access to telemetry that records process command lines. The exposure window may be brief, but repeated or long-running requests increase the opportunity for capture.
Impact Assessment
A successful attacker can obtain the privileges associated with the compromised PoYo API key. This may allow unauthorized video-generation jobs, consumption of account credits, access to API oper ...[truncated 325 chars]
- A user exports a valid
- Remediation
View remediation
Remediation Suggestions
Avoid placing the authorization value directly in
curlcommand-line arguments.- Provide sensitive curl options through a protected configuration stream or file rather than ordinary process arguments.
- If a temporary configuration file is necessary, create it with restrictive permissions such as mode
0600, store it in a trusted directory, and remove it reliably with a shelltrap. - Prefer a client implementation that constructs HTTP headers in process memory without exposing their values through the argument vector.
- Ensure shell tracing is disabled around secret handling and verify that errors, debug output, process telemetry, and audit logs do not record authorization headers.
- Keep
POYO_API_KEYin a server-side secret manager or protected environment variable, rotate the currently used key if process arguments may have been collected, and apply the least privileges supported by PoYo. - Add an automated regression check that fails when secret environment variables are interpolated into executable command arguments.