T09 · Insecure Skill Coding Practices
- Location
scripts/submit_nano_banana.sh:4- Finding
API Key Exposure Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/submit_nano_banana.sh, lines 4–6
Vulnerability Type: API credential exposure through process arguments and shell history
Risk Level: MediumVulnerable Code
sh api_key="${POYO_API_KEY:-${1:-}}" if [ -z "$api_key" ]; then echo "Usage: submit_nano_banana.sh [api_key] [payload.json]" >&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2Technical Analysis
When
POYO_API_KEYis unset, the script accepts the API key as its first positional command-line argument. Secrets supplied this way can be recorded in shell history, process-accounting systems, terminal logs, job telemetry, CI/CD logs, and command-line audit records. Depending on operating-system process visibility and timing, another local user may also read the argument from process metadata while the script is running.Although the script also supports the safer
POYO_API_KEYenvironment variable, its usage instructions explicitly promote the insecure positional-argument option.Attack Path
- A user runs the script as documented:
sh scripts/submit_nano_banana.sh "$API_KEY" payload.json - The API key becomes part of the command-line invocation.
- The invocation is retained in shell history, operational telemetry, process accounting, or CI logs, or is observed through process inspection while running.
- An attacker with access to that local metadata retrieves the key.
- The attacker uses the credential to make unauthorized requests to the PoYo API.
This path requires access to the affected host, its logs, or its command telemetry; the script does not independently transmit the key to an undeclared destination.
Impact Assessment
Successful exploitation exposes the user's PoYo API credential. An attacker may submit requests under the victim's account, consume paid quota, incur charges, or access other API functionality authorized to ...[truncated 162 chars]
- A user runs the script as documented:
- Remediation
View remediation
Remediation Suggestions
- Remove positional command-line support for
POYO_API_KEY. - Require the credential through
POYO_API_KEYor a protected secret-management mechanism. - If interactive entry is needed, read the key without terminal echo rather than placing it in an argument:
sh if [ -z "${POYO_API_KEY:-}" ]; then printf 'PoYo API key: ' >&2 stty -echo IFS= read -r POYO_API_KEY stty echo printf '\n' >&2 fi api_key="$POYO_API_KEY" - For automation, inject the variable from a CI/CD secret store and configure log masking.
- Change the interface so the only positional argument is the payload file:
sh : "${POYO_API_KEY:?POYO_API_KEY must be set}" api_key="$POYO_API_KEY" payload="${1:-}" - Update
SKILL.mdand the script's usage output to prohibit passing credentials on the command line. - Rotate any API key previously supplied as an argument if command history or execution logs may have been retained.
- Remove positional command-line support for