T09 · Insecure Skill Coding Practices
- Location
scripts/submit_kling_1_6.sh:12- Finding
API Key Exposed Through Process Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/submit_kling_1_6.sh, lines 12–16
Vulnerability Type: Bearer token disclosure through process arguments
Risk Level: Mediumbash curl --fail-with-body --request POST \ --url "https://api.poyo.ai/api/generate/submit" \ --header "Authorization: Bearer ${POYO_API_KEY}" \ --header "Content-Type: application/json" \ --data @"${payload_file}"Technical Analysis
The shell expands
POYO_API_KEYbefore executingcurl, placing the complete bearer token in the process argument vector as part of the--headerargument. While the request is running, local users or monitoring software with sufficient process-inspection privileges may be able to retrieve that argument through facilities such asps,/proc, audit logs, process telemetry, or diagnostic tooling.Although the token is not hardcoded in the repository and transport uses HTTPS, passing it as a command-line argument weakens secret confidentiality at the local host boundary. This also conflicts with the project's documented requirement to avoid exposing API keys in logs.
Attack Path
- A user sets
POYO_API_KEYand invokesscripts/submit_kling_1_6.shwith a payload. - The shell expands
${POYO_API_KEY}into thecurlcommand-line argument vector. - During request execution, a local observer with permission to inspect the process command line captures the expanded
Authorizationheader. - The observer extracts the bearer token.
- The observer reuses the token to authenticate unauthorized requests to the PoYo API until the key is revoked or expires.
Exploitation requires local process visibility or access to command-line telemetry; it is not directly exploitable by a remote party solely through this script.
Impact Assessment
A captured API key could allow an attacker to submit requests under the victim's PoYo account, consume paid quota, incur costs, and access any A ...[truncated 196 chars]
- A user sets
- Remediation
View remediation
Remediation Suggestions
Avoid placing the bearer token directly in
curlcommand-line arguments. Provide the sensitive header through a protected configuration source, such as a temporary curl configuration file with permissions set to0600, and guarantee cleanup with a shell trap.Recommended hardening measures:
- Create temporary secret-bearing files with a restrictive
umask, such asumask 077. - Register
trapcleanup immediately after creating the temporary file. - Write the authorization header to the protected curl configuration rather than passing it through
--headeron the command line. - Ensure secret-bearing files are never stored in the project directory, committed, logged, or retained after execution.
- Limit process and telemetry access on shared systems.
- Redact authorization headers from shell tracing, audit output, and diagnostic logs.
- Rotate
POYO_API_KEYif process telemetry may already have recorded it. - Prefer short-lived, narrowly scoped credentials when supported by the service.
- Create temporary secret-bearing files with a restrictive