T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/submit_wan_2_6.sh:4- Finding
PoYo API Key Exposed Through Process Arguments and Optional Positional Input
- Content
View full analysis
&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2 exit 1 fi payload="${2:-${1:+}}" if [ -n "${POYO_API_KEY:-}" ]; then payload="${1:-}" fi if [ -n "$payload" ] && [ "$payload" != "$api_key" ]; then body=$(cat "$payload") else body=$(cat) fi curl -sS https://api.poyo.ai/api/generate/submit -H "Authorization: Bearer $api_key" -H 'Content-Type: application/json' -d "$body" ``` ### Technical Analysis The script accepts the PoYo API key as the first positional argument when `POYO_API_KEY` is not set. Supplying a secret this way can disclose it through shell history and through the script process's command-line arguments. The script also expands the key directly into curl's `Authorization` header argument. Consequently, the bearer token is included in curl's argument vector while curl is running. On systems where process arguments are visible to other users or processes, a local attacker may retrieve the token through process-inspection interfaces or monitoring tools. Using the environment variable prevents the key from appearing in the original shell command, but it does not prevent the later curl invocation from placing the expanded token in curl's process arguments. ### Attack Path 1. A user supplies a valid PoYo API key as a positional argument or through `POYO_API_KEY`. 2. The script expands the key into the curl command as `Authorization: Bearer `. 3. A local attacker with permission to inspect the user's process arguments monitors the curl process and captures the header argument. 4. If the key was supplied positionally, the attac ...[truncated 803 chars]- Remediation
View remediation