T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/submit_gpt_4o_image.sh:4- Finding
API Credentials and Sensitive Request Data Exposed Through Process Arguments
- Content
View full analysis
&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2 exit 1 fi payload="${2:-${1:+}}" if [ -n "${POYO_API_KEY:-}" ]; then payload="${1:-}" fi if [ -n "$payload" ] && [ "$payload" != "$api_key" ]; then body=$(cat "$payload") else body=$(cat) fi curl -sS https://api.poyo.ai/api/generate/submit -H "Authorization: Bearer $api_key" -H 'Content-Type: application/json' -d "$body" ``` ### Technical Analysis The script permits the PoYo API key to be supplied as its first positional command-line argument. Credentials entered this way can be retained in shell history and exposed through process-inspection interfaces while the script is running. The script also expands the API key and the entire JSON request body into the arguments passed to `curl`: ```sh -H "Authorization: Bearer $api_key" -d "$body" ``` Consequently, the `curl` process command line can contain both the Bearer credential and sensitive request content. Depending on the operating system's process-inspection restrictions, another local user, a process running under the same account, or a privileged process may be able to inspect these arguments. Request bodies may contain private prompts, callback URLs, reference-image URLs, mask URLs, or other user-controlled metadata. This issue does not establish remote compromise by itself. Exploitation requires access to command history or sufficient local permission to inspect the affected processes. ### Attack Path 1. A victim invokes the script with the API key as a positional argument or supplies it through `POYO_API_KEY`. 2. ...[truncated 1394 chars]- Remediation
View remediation