T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/submit_seedance_1_5_pro.sh:4- Finding
PoYo API Key Exposure Through Command-Line Arguments
- Content
View full analysis
&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2 exit 1 fi payload="${2:-${1:+}}" if [ -n "${POYO_API_KEY:-}" ]; then payload="${1:-}" fi if [ -n "$payload" ] && [ "$payload" != "$api_key" ]; then body=$(cat "$payload") else body=$(cat) fi curl -sS https://api.poyo.ai/api/generate/submit -H "Authorization: Bearer $api_key" -H 'Content-Type: application/json' -d "$body" ``` ### Technical Analysis The script explicitly accepts the PoYo API key as its first positional argument when `POYO_API_KEY` is not set. Supplying a secret on a command line can record it in the user's shell history. While the command is running, it may also be exposed through process metadata to local users or processes that are permitted to inspect the invocation. Regardless of whether the key originates from the environment or a positional argument, the final `curl` command expands it into the `Authorization` header passed in curl's argument vector: ```sh -H "Authorization: Bearer $api_key" ``` Consequently, the bearer credential may be observable in curl's process arguments during request execution. Exploitation requires local process-inspection access or access to the invoking user's shell history, so this is not an unauthenticated remote vulnerability. ### Attack Path 1. A user invokes the script with the API key as documented, for example: ```sh ./scripts/submit_seedance_1_5_pro.sh SECRET_API_KEY payload.json ``` 2. The command, including the plaintext key, may be retained in the user's shell-history file. 3. The script al ...[truncated 964 chars]- Remediation
View remediation