T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/submit_seedream_5_0_lite.sh:4- Finding
API Key Exposure Through Command-Line Arguments
- Content
View full analysis
&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2 ``` ### Technical Analysis When `POYO_API_KEY` is not set, the script accepts the API key as its first positional command-line argument. The usage instructions explicitly encourage this invocation method. Command-line arguments can be exposed through local process inspection utilities, process-monitoring systems, execution telemetry, audit logs, shell history, job schedulers, or wrapper scripts that record invoked commands. Although exposure depends on the host environment and process visibility controls, command-line arguments are not an appropriate transport mechanism for long-lived credentials. The exposed key is subsequently used as a Bearer token for the PoYo API. An attacker who captures it can authenticate independently of the script. ### Attack Path 1. A user runs the script without setting `POYO_API_KEY`, supplying the API key as the first command-line argument. 2. The plaintext key becomes part of the process argument list and may also remain in shell history, monitoring telemetry, scheduler configuration, or wrapper logs. 3. A local user or component with access to one of those data sources retrieves the key. 4. The attacker sends requests directly to the PoYo API using the captured Bearer token. 5. Those requests are attributed to and potentially billed against the victim's account. ### Impact Assessment Successful exploitation exposes the privileges associated with the compromised PoYo API key. An attacker could submit unauthorized image-generation or editing jobs, consume a ...[truncated 320 chars]- Remediation
View remediation
&2 echo "Usage: POYO_API_KEY=... submit_seedream_5_0_lite.sh [payload.json]" >&2 exit 1 fi payload="${1:-}" ``` ]]>