T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/submit_gpt_image_1_5.sh:4
- Finding
- API Key Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/submit_gpt_image_1_5.sh`, lines 4–7 **Vulnerability Type**: API key exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```sh api_key="${POYO_API_KEY:-${1:-}}" if [ -z "$api_key" ]; then echo "Usage: submit_gpt_image_1_5.sh [api_key] [payload.json]" >&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2 exit 1 fi ``` ### Technical Analysis The script permits `POYO_API_KEY` to be supplied as its first positional command-line argument and explicitly advertises that invocation method. Secrets passed through command-line arguments can be exposed through shell history, process inspection facilities, audit records, diagnostic tooling, job metadata, or command logging. Although the key is transmitted to the declared PoYo HTTPS endpoint, accepting it through an argument creates an unnecessary local disclosure channel. Exploitation requires access to a system or record capable of observing the invocation, such as another appropriately privileged local account, an administrator, a monitoring agent, or a party with access to retained shell or orchestration logs. ### Attack Path 1. A user follows the advertised usage and invokes the script with a PoYo API key as the first argument. 2. The full command may be retained in shell history or exposed temporarily through process and audit metadata. 3. An attacker with access to that data retrieves the API key. 4. The attacker reuses the bearer credential directly against the PoYo API. 5. Requests are submitted under the victim's account until the credential is revoked or otherwise becomes invalid. ### Impact Assessment A disclosed key may allow unauthorized use of the victim's PoYo account within the permissions assigned to that key. Potential consequences include unauthorized or billable image-generation requests, quota consumption, and access to API operations ...[truncated 233 chars]
- Remediation
- ## Remediation Suggestions - Remove support for accepting the API key as a positional command-line argument. - Require `POYO_API_KEY` to be supplied through a protected environment or secret-management facility. - Change the key assignment to fail unless the environment variable exists: ```sh api_key="${POYO_API_KEY:?POYO_API_KEY must be set}" ``` - Update the usage instructions so they no longer encourage placing credentials in command lines. - In automated environments, inject the key from the platform's secret store and prevent it from being included in logs or job metadata. - Rotate any API key previously passed on a command line if shell history, audit records, or execution logs may be accessible to untrusted parties.