T09 · Insecure Skill Coding Practices
- Location
scripts/submit_seedream_4_5.sh:4- Finding
API Key Exposure Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/submit_seedream_4_5.sh, lines 4-10
Vulnerability Type: API credential exposure through process arguments and shell history
Risk Level: MediumVulnerable Code:
sh api_key="${POYO_API_KEY:-${1:-}}" if [ -z "$api_key" ]; then echo "Usage: submit_seedream_4_5.sh [api_key] [payload.json]" >&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2 exit 1 fi payload="${2:-${1:+}}"Technical Analysis
The script accepts the PoYo API key as its first positional command-line argument when
POYO_API_KEYis unset. Secrets supplied this way may be recorded in interactive shell history and can be exposed through process inspection or endpoint-monitoring telemetry while the command is running.The usage message explicitly encourages this insecure invocation pattern. Although the key is legitimately needed to authenticate to PoYo, placing it in the process argument vector creates unnecessary local disclosure risk.
Attack Path
- A user runs the script using the documented positional-key mode:
sh scripts/submit_seedream_4_5.sh 'POYO_API_KEY_VALUE' payload.json - The plaintext key is stored in shell history or temporarily exposed in the process command line.
- A local user or monitoring component with access to that information retrieves the key.
- The observer uses the stolen Bearer credential to submit unauthorized requests to the PoYo API.
Exploitation requires access to relevant local process metadata, command history, or captured command telemetry.
Impact Assessment
A successful attacker obtains the victim's PoYo API credential. Within the permissions assigned to that key, the attacker may submit unauthorized image-generation or editing tasks, consume the victim's service credits, and impersonate the victim when accessing supported PoYo API operation ...[truncated 113 chars]
- A user runs the script using the documented positional-key mode:
- Remediation
View remediation
Remediation Suggestions
- Remove all positional command-line API-key support.
- Require
POYO_API_KEYto be supplied through the environment or a protected secret-management mechanism. - Update the usage instructions so they never recommend placing credentials in command arguments.
- Fail safely when the environment variable is absent:
sh api_key="${POYO_API_KEY:-}" if [ -z "$api_key" ]; then echo "POYO_API_KEY must be set." >&2 exit 1 fi payload="${1:-}" - Prefer injecting the environment variable directly for the process through a secret manager rather than placing an export command containing the key in persistent shell configuration or history.
- Advise users who previously invoked the positional-key mode to clear exposed history or telemetry where feasible and rotate the affected API key.