T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/submit_z_image.sh:4
- Finding
- Bearer API Key Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/submit_z_image.sh`, lines 4–7 **Vulnerability Type**: Command-line secret exposure **Risk Level**: Medium ### Vulnerable Code ```sh api_key="${POYO_API_KEY:-${1:-}}" if [ -z "$api_key" ]; then echo "Usage: submit_z_image.sh [api_key] [payload.json]" >&2 echo "Or set POYO_API_KEY and pass [payload.json]. If no payload file is given, JSON is read from stdin." >&2 ``` ### Technical Analysis The script accepts the PoYo bearer API key as its first positional argument when `POYO_API_KEY` is unset. Secrets supplied on the command line may be recorded in shell history, process-execution logs, terminal auditing systems, or automation logs. Depending on operating-system process visibility and hardening, another local user may also be able to inspect the argument while the process is running. Because the key is subsequently used in the `Authorization` header, disclosure gives an attacker the same PoYo API authorization available to the legitimate key holder. ### Attack Path 1. A user invokes the supported argument-based mode, for example: ```sh scripts/submit_z_image.sh REAL_API_KEY payload.json ``` 2. The plaintext key becomes part of the command line. 3. The command is retained in shell history, captured by monitoring or CI logs, or observed through process inspection. 4. An actor with access to that source extracts the bearer key. 5. The actor sends authenticated requests to the PoYo API using the compromised credential. Exploitation requires access to command history, process metadata, or execution logs; the audited code does not provide remote access to these sources by itself. ### Impact Assessment A successful attacker can act with the API permissions assigned to the exposed PoYo key. This may permit unauthorized image-generation submissions, consumption of account quota or credits, and access to other API operations authorized for that credential. The issue does not directly provide local ...[truncated 88 chars]
- Remediation
- ## Remediation Suggestions 1. Remove positional API-key support and require `POYO_API_KEY` to be supplied through a protected environment or secret manager. 2. Change the initialization to fail unless the environment variable is present: ```sh api_key="${POYO_API_KEY:-}" if [ -z "$api_key" ]; then echo "POYO_API_KEY must be set." >&2 exit 1 fi ``` 3. Update usage documentation so it never recommends placing a real key directly in a command. 4. In CI/CD environments, inject the key through a masked secret facility and prevent secret values from appearing in job logs. 5. Apply least privilege to the API credential and rotate any key previously passed through command-line arguments if command histories or logs may be accessible. 6. Where supported, use short-lived or narrowly scoped credentials and monitor the account for unexpected API usage.