T09 · Insecure Skill Coding Practices
- Location
scripts/submit_seedance_2.sh:4- Finding
API Key Exposure Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/submit_seedance_2.sh, lines 4–7
Vulnerability Type: Credential exposure through process arguments and shell history
Risk Level: MediumVulnerable Code
sh api_key="${POYO_API_KEY:-${1:-}}" if [ -z "$api_key" ]; then echo "Usage: submit_seedance_2.sh [api_key] [payload.json]" >&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2 exit 1 fiTechnical Analysis
When
POYO_API_KEYis unset, the script reads the API key from its first positional argument. Supplying secrets through command-line arguments is unsafe because the invocation may be retained in shell-history files. While the script is running, the argument may also be visible through operating-system process inspection facilities to users or monitoring tools with sufficient local access.The usage instructions explicitly advertise this insecure invocation method, increasing the likelihood that users will expose their credentials.
Attack Path
-
A user runs the script using the documented positional-key form:
sh scripts/submit_seedance_2.sh SECRET_API_KEY payload.json -
The complete command, including the API key, may be written to the user's shell history.
-
While the command executes, the key may also be exposed in process metadata.
-
A local actor, administrator, diagnostic tool, log collector, or later reader of the history file obtains the key.
-
The exposed key is used to submit unauthorized requests to the PoYo API.
This path requires access to the relevant local process information, command history, or collected telemetry; it does not provide remote compromise by itself.
Impact Assessment
An attacker who obtains the API key can authenticate to PoYo with the privileges associated with that credential. This may allow unauthorized video-generation requests, consumption of account credits or quota, and access to any other API ...[truncated 134 chars]
-
- Remediation
View remediation
Remediation Suggestions
-
Remove support for API keys supplied as positional command-line arguments.
-
Require the key through
POYO_API_KEY, preferably populated by a secrets manager or protected runtime environment. -
If interactive entry is necessary, read the key from a terminal with input echo disabled rather than from
argv. -
Revise the usage message so it no longer recommends passing a key on the command line.
-
Document safe secret handling, including avoiding shell history, scripts, source files, and logs.
-
Advise users who previously used the positional form to rotate potentially exposed keys.
-
A hardened implementation could begin with:
sh api_key="${POYO_API_KEY:-}" if [ -z "$api_key" ]; then echo "POYO_API_KEY must be set." >&2 exit 1 fi
-