T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/submit_nano_banana_2.sh:10
- Finding
- PoYo API Key Exposed Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/submit_nano_banana_2.sh`, lines 10-26 **Vulnerability Type**: Credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash submit_nano_banana_2.sh "$POYO_API_KEY" payload.json EOF exit 1 fi if [[ $# -eq 1 ]]; then : "${POYO_API_KEY:?POYO_API_KEY is required when api_key is not passed explicitly}" api_key="$POYO_API_KEY" payload_file="$1" else api_key="$1" payload_file="$2" fi curl -sS https://api.poyo.ai/api/generate/submit \ -H "Authorization: Bearer ${api_key}" \ ``` ### Technical Analysis The script supports supplying the PoYo API key as its first positional argument. Command-line arguments can be captured by process inspection tools, monitoring agents, audit logs, shell debugging facilities, or other local users where process visibility is permitted. Regardless of whether the key originates from a positional argument or `POYO_API_KEY`, the script subsequently interpolates it into curl's `-H` command-line argument. While curl is running, the complete `Authorization: Bearer ...` header may therefore be visible in curl's process arguments. Using an environment variable at script invocation does not prevent this second exposure. The issue does not provide remote code execution or elevated operating-system privileges by itself. Exploitation requires local process visibility or access to telemetry that records command lines. ### Attack Path 1. A user starts the script with a valid PoYo API key, either as a positional argument or through `POYO_API_KEY`. 2. The script places the credential in the `api_key` variable and expands it into curl's authorization-header argument. 3. A local observer, process-monitoring agent, or logging system captures the script or curl command line while the process is active. 4. The observer extracts the bearer token from the captured arguments. 5. The observer reuses the token to authenticate directly to the PoYo ...[truncated 543 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove support for passing the API key as a positional command-line argument. 2. Retrieve the credential from a dedicated secret manager or a protected environment variable. 3. Avoid expanding the bearer token into curl's command-line arguments. Place the authorization header in a temporary curl configuration file with permissions set to `0600`, pass that file using `curl --config`, and delete it reliably with an `EXIT` trap. 4. Create temporary files with `mktemp` in a trusted directory and apply a restrictive `umask`, such as `umask 077`. 5. Ensure debugging and verbose modes do not print authorization headers or secret-bearing configuration. 6. Rotate any API key that may already have been exposed through process inspection or command-line telemetry. 7. Where supported, use short-lived and least-privileged API credentials to reduce the impact of disclosure. ]]>