T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/submit_grok_imagine.sh:4- Finding
PoYo API Key Exposed Through Process Command-Line Arguments
- Content
View full analysis
&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2 exit 1 fi payload="${2:-${1:+}}" if [ -n "${POYO_API_KEY:-}" ]; then payload="${1:-}" fi if [ -n "$payload" ] && [ "$payload" != "$api_key" ]; then body=$(cat "$payload") else body=$(cat) fi curl -sS https://api.poyo.ai/api/generate/submit -H "Authorization: Bearer $api_key" -H 'Content-Type: application/json' -d "$body" ``` ### Technical Analysis The script supports supplying the PoYo API key as its first positional argument. Secrets passed this way can be retained in shell history and captured by command telemetry, audit systems, process wrappers, or other local monitoring facilities. Additionally, regardless of whether the key originates from the environment or a positional argument, the script expands it directly into curl's authorization-header argument: ```sh -H "Authorization: Bearer $api_key" ``` Consequently, the resulting curl process receives the complete Bearer credential in its argument vector. On systems where process arguments are visible to other users, privileged monitoring agents, audit services, or diagnostic tooling, the credential may be recorded or observed while the request is running. The issue does not enable a remote attacker to retrieve the key directly. Exploitation requires access to process metadata, command history, telemetry, or logs on the host where the script runs. ### Attack Path 1. A victim invokes the script with a valid PoYo API key, either as the first positional argument or through `POYO_API_KEY`. 2. If supplied positionally, the key m ...[truncated 1045 chars]- Remediation
View remediation