T09 · Insecure Skill Coding Practices
- Location
scripts/submit_kling_2_6_motion_control.sh:4- Finding
PoYo API Credential Exposure Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/submit_kling_2_6_motion_control.sh, lines 4–7 and 22
Vulnerability Type: API credential exposure through shell history and process arguments
Risk Level: MediumVulnerable Code
sh api_key="${POYO_API_KEY:-${1:-}}" if [ -z "$api_key" ]; then echo "Usage: submit_kling_2_6_motion_control.sh [api_key] [payload.json]" >&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2 exit 1 fi # ... curl -sS https://api.poyo.ai/api/generate/submit -H "Authorization: Bearer $api_key" -H 'Content-Type: application/json' -d "$body"Technical Analysis
The script permits a PoYo API key to be supplied as its first positional argument. This can persist the credential in shell history, terminal logging, command auditing, or process-launch telemetry.
Additionally, the script expands the API key directly into curl's
-Hcommand-line argument. During execution, the resultingAuthorization: Bearer ...value may be observable through process inspection facilities, monitoring agents, audit systems, or diagnostic tooling. This exposure occurs even when the key originally comes fromPOYO_API_KEY, because it is subsequently expanded into curl's argument vector.Exploitation requires local process visibility, access to captured shell history, or access to process/audit telemetry. The script does not itself transmit the credential to an unrelated endpoint; it sends it to the documented PoYo API.
Attack Path
- A user invokes the script with a valid PoYo API key as a positional argument, or supplies it through
POYO_API_KEY. - If supplied positionally, the key may be recorded in shell history or command logs.
- The script expands the key into curl's authorization-header argument.
- A local user, monitoring process, audit collector, or party with access to command telemetry captures the bearer token.
- The attacker reuses the toke ...[truncated 631 chars]
- A user invokes the script with a valid PoYo API key as a positional argument, or supplies it through
- Remediation
View remediation
Remediation Suggestions
- Remove support for supplying the API key as a positional argument. Require a protected environment variable, private credential file, or operating-system secret provider.
- Do not expand the bearer token directly into curl's argument vector.
- Supply the authorization header through a securely permissioned curl configuration file or another mechanism that does not expose the token in process arguments.
- If temporary credential material is unavoidable:
- Create it with restrictive permissions such as
0600. - Use a private temporary directory.
- Register a
trapto remove it on normal exit and signals. - Never place it in a shared or predictable path.
- Create it with restrictive permissions such as
- Document that users must not enter API keys directly on command lines or store them in payload files.
- Rotate any credential that may already have appeared in shell history, process telemetry, or command audit logs.
- Restrict local process inspection and access to command histories and monitoring logs according to least privilege.