T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/submit_kling_3_0.sh:12
- Finding
- PoYo API Key Exposed Through Process Command-Line Arguments## Vulnerability Details **File Location**: `scripts/submit_kling_3_0.sh`, lines 12–15 **Vulnerability Type**: API credential exposure through process arguments **Risk Level**: Medium ```bash curl --fail-with-body --request POST \ --url "https://api.poyo.ai/api/generate/submit" \ --header "Authorization: Bearer ${POYO_API_KEY}" \ ``` ### Technical Analysis The shell expands `${POYO_API_KEY}` before starting `curl`, placing the complete bearer credential in the process argument vector. Depending on operating-system process visibility and monitoring configuration, command-line arguments may be exposed through process inspection interfaces, diagnostic tools, audit systems, or process telemetry. This implementation also contradicts the explicit security requirement in `SKILL.md` that API keys must not be passed as command-line arguments. Quoting the variable prevents shell word splitting but does not prevent credential exposure in the spawned process's arguments. ### Attack Path 1. A user exports a valid `POYO_API_KEY` and invokes `scripts/submit_kling_3_0.sh` with a payload. 2. The script expands the environment variable into the `--header` argument passed to `curl`. 3. While `curl` is running, a local actor or monitoring component with permission to inspect that process reads its command-line arguments. 4. The actor extracts the bearer token from the `Authorization` header. 5. The stolen token is used to submit unauthorized requests to the PoYo API until it is revoked or expires. Exploitation requires local process-inspection access or access to telemetry that records process command lines. The exposure window may be brief, but repeated or long-running requests increase the opportunity for capture. ### Impact Assessment A successful attacker can obtain the privileges associated with the compromised PoYo API key. This may allow unauthorized video-generation jobs, consumption of account credits, access to API oper ...[truncated 325 chars]
- Remediation
- ## Remediation Suggestions Avoid placing the authorization value directly in `curl` command-line arguments. - Provide sensitive curl options through a protected configuration stream or file rather than ordinary process arguments. - If a temporary configuration file is necessary, create it with restrictive permissions such as mode `0600`, store it in a trusted directory, and remove it reliably with a shell `trap`. - Prefer a client implementation that constructs HTTP headers in process memory without exposing their values through the argument vector. - Ensure shell tracing is disabled around secret handling and verify that errors, debug output, process telemetry, and audit logs do not record authorization headers. - Keep `POYO_API_KEY` in a server-side secret manager or protected environment variable, rotate the currently used key if process arguments may have been collected, and apply the least privileges supported by PoYo. - Add an automated regression check that fails when secret environment variables are interpolated into executable command arguments.