T09 · Insecure Skill Coding Practices
- Location
scripts/submit_gpt_image_1_5.sh:4- Finding
API Key Exposure Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/submit_gpt_image_1_5.sh, lines 4–7
Vulnerability Type: API key exposure through process arguments and shell history
Risk Level: MediumVulnerable Code
sh api_key="${POYO_API_KEY:-${1:-}}" if [ -z "$api_key" ]; then echo "Usage: submit_gpt_image_1_5.sh [api_key] [payload.json]" >&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2 exit 1 fiTechnical Analysis
The script permits
POYO_API_KEYto be supplied as its first positional command-line argument and explicitly advertises that invocation method. Secrets passed through command-line arguments can be exposed through shell history, process inspection facilities, audit records, diagnostic tooling, job metadata, or command logging.Although the key is transmitted to the declared PoYo HTTPS endpoint, accepting it through an argument creates an unnecessary local disclosure channel. Exploitation requires access to a system or record capable of observing the invocation, such as another appropriately privileged local account, an administrator, a monitoring agent, or a party with access to retained shell or orchestration logs.
Attack Path
- A user follows the advertised usage and invokes the script with a PoYo API key as the first argument.
- The full command may be retained in shell history or exposed temporarily through process and audit metadata.
- An attacker with access to that data retrieves the API key.
- The attacker reuses the bearer credential directly against the PoYo API.
- Requests are submitted under the victim's account until the credential is revoked or otherwise becomes invalid.
Impact Assessment
A disclosed key may allow unauthorized use of the victim's PoYo account within the permissions assigned to that key. Potential consequences include unauthorized or billable image-generation requests, quota consumption, and access to API operations ...[truncated 233 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove support for accepting the API key as a positional command-line argument.
- Require
POYO_API_KEYto be supplied through a protected environment or secret-management facility. - Change the key assignment to fail unless the environment variable exists:
sh api_key="${POYO_API_KEY:?POYO_API_KEY must be set}"- Update the usage instructions so they no longer encourage placing credentials in command lines.
- In automated environments, inject the key from the platform's secret store and prevent it from being included in logs or job metadata.
- Rotate any API key previously passed on a command line if shell history, audit records, or execution logs may be accessible to untrusted parties.