T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/submit_seedance_1_5_pro.sh:4
- Finding
- PoYo API Key Exposure Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/submit_seedance_1_5_pro.sh`, lines 4-22 **Vulnerability Type**: API credential exposure through shell history and process arguments **Risk Level**: Medium ### Vulnerable Code ```sh api_key="${POYO_API_KEY:-${1:-}}" if [ -z "$api_key" ]; then echo "Usage: submit_seedance_1_5_pro.sh [api_key] [payload.json]" >&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2 exit 1 fi payload="${2:-${1:+}}" if [ -n "${POYO_API_KEY:-}" ]; then payload="${1:-}" fi if [ -n "$payload" ] && [ "$payload" != "$api_key" ]; then body=$(cat "$payload") else body=$(cat) fi curl -sS https://api.poyo.ai/api/generate/submit -H "Authorization: Bearer $api_key" -H 'Content-Type: application/json' -d "$body" ``` ### Technical Analysis The script explicitly accepts the PoYo API key as its first positional argument when `POYO_API_KEY` is not set. Supplying a secret on a command line can record it in the user's shell history. While the command is running, it may also be exposed through process metadata to local users or processes that are permitted to inspect the invocation. Regardless of whether the key originates from the environment or a positional argument, the final `curl` command expands it into the `Authorization` header passed in curl's argument vector: ```sh -H "Authorization: Bearer $api_key" ``` Consequently, the bearer credential may be observable in curl's process arguments during request execution. Exploitation requires local process-inspection access or access to the invoking user's shell history, so this is not an unauthenticated remote vulnerability. ### Attack Path 1. A user invokes the script with the API key as documented, for example: ```sh ./scripts/submit_seedance_1_5_pro.sh SECRET_API_KEY payload.json ``` 2. The command, including the plaintext key, may be retained in the user's shell-history file. 3. The script al ...[truncated 964 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove positional API-key support and require `POYO_API_KEY` to be supplied through an approved secret manager or protected runtime environment. 2. Update the usage text so it never encourages users to place credentials directly on the command line. 3. Avoid expanding the authorization header into curl's argument vector. Supply sensitive curl configuration through a permission-restricted temporary configuration file or another mechanism that does not expose the token through process arguments. 4. If a temporary configuration file is necessary: - Create it with permissions restricted to the current user, such as mode `0600`. - Use `mktemp` rather than a predictable path. - Register a shell `trap` to delete it on normal exit, interruption, and failure. - Ensure it is stored on an appropriately protected filesystem. 5. Document key rotation procedures and advise users who previously passed keys positionally to remove affected shell-history entries and rotate those credentials. 6. Consider using a dedicated, least-privileged PoYo key with account-level spending or quota limits to reduce the impact of credential compromise. ]]>