T09 · Insecure Skill Coding Practices
- Location
scripts/submit_seedream_5_pro.sh:11- Finding
PoYo API Key Exposed in Process Arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/submit_seedream_5_pro.sh, lines 11-15
Vulnerability Type: Bearer token disclosure through command-line arguments
Risk Level: MediumVulnerable Code
bash curl --fail-with-body --request POST \ --url "https://api.poyo.ai/api/generate/submit" \ --header "Authorization: Bearer ${POYO_API_KEY}" \ --header "Content-Type: application/json" \ --data @"$1"Technical Analysis
The shell expands
${POYO_API_KEY}before startingcurl, placing the complete authorization header in the process argument vector. While the request is in progress, local process-inspection facilities, diagnostic utilities, audit systems, or process-monitoring agents may capture the command line and expose the bearer token.Exploitation requires the ability to observe the
curlprocess arguments, which is commonly available to the same operating-system user, privileged local users, or authorized monitoring infrastructure. The fixed HTTPS endpoint prevents arbitrary endpoint redirection but does not protect the credential from local disclosure.Attack Path
- A legitimate user exports
POYO_API_KEYand invokes the submission helper with a reviewed JSON payload. - The script expands the key into the
--headerargument and startscurl. - An attacker with sufficient local process-observation access inspects the running command line or obtains it from process telemetry.
- The attacker extracts the bearer token from
Authorization: Bearer .... - The attacker reuses the token to authenticate directly to the PoYo API until the key is revoked or expires.
Impact Assessment
Successful exploitation discloses the PoYo API credential. The attacker obtains the API permissions associated with that key and may submit unauthorized generation requests, consume account credits or quotas, and access any other PoYo operations authorized for the credential.
This i ...[truncated 198 chars]
- A legitimate user exports
- Remediation
View remediation
Remediation Suggestions
- Do not place bearer tokens directly in command-line arguments.
- Pass the sensitive header through a protected input channel, such as a curl configuration supplied over standard input or a permission-restricted temporary configuration file.
- If a temporary file is necessary, create it with mode
0600, use a securely generated path, install an exit trap to remove it, and prevent backups or logs from retaining it. - Remove
POYO_API_KEYfrom the child process environment when startingcurlif the header has already been supplied through another secure channel. - Ensure shell tracing is disabled and prevent request headers from being included in verbose output, debug logs, crash reports, or monitoring telemetry.
- Apply least privilege to the PoYo key, rotate it periodically, and revoke it immediately if process arguments may have been captured.