T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:41
- Finding
- API credentials may be transmitted in URL query strings## Vulnerability Details **File Location**: `SKILL.md`, line 41 **Vulnerability Type**: API credential exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown **Note:** All endpoints accept an optional `api_key` query parameter as an alternative to x402 payment. All endpoint URLs require a trailing slash where shown. ``` ### Technical Analysis The Skill explicitly permits an API key to be included as a URL query parameter. URLs are commonly recorded by HTTP servers, reverse proxies, gateways, observability platforms, error-reporting systems, and request-history mechanisms. As a result, a secret placed in the query string can be exposed to systems and personnel that do not require access to the credential. The project contains documentation rather than the underlying API or gateway implementation, so the precise retention behavior cannot be established from the reviewed files. Nevertheless, the documented authentication mechanism encourages an inherently unsafe credential transport pattern. ### Attack Path 1. A user configures the Skill to authenticate with an API key instead of x402 payment. 2. The agent places the key in the request URL as an `api_key` query parameter. 3. An API gateway, reverse proxy, server, monitoring service, or error-reporting system records the complete URL. 4. A party with access to those records obtains the API key. 5. The exposed key is reused to issue unauthorized DappLooker API requests. ### Impact Assessment An attacker who obtains the key may gain the same DappLooker API access granted to its legitimate owner. The resulting scope depends on server-side permissions and limits associated with that key. Potential consequences include unauthorized paid API usage, consumption of quotas, financial charges, and access to any data available under the compromised credential. This issue does not, based on the reviewed files, grant local code execution, operating-system privileges, pers ...[truncated 44 chars]
- Remediation
- ## Remediation Suggestions 1. Remove support for authentication through the `api_key` query parameter. 2. Transmit credentials through a dedicated request header, preferably: ```http Authorization: Bearer <api-key> ``` 3. Store the key in an approved secret manager or protected runtime credential store rather than embedding it in Skill text, prompts, or URLs. 4. Configure clients, gateways, servers, and telemetry systems to redact authentication headers and known secret fields. 5. Ensure request logs do not retain full query strings where sensitive parameters may still be accepted for backward compatibility. 6. If query-parameter authentication cannot be removed immediately, deprecate it, apply short expiration periods and least-privilege scopes to keys, and prevent referrer propagation. 7. Rotate any API keys that may previously have appeared in URLs or logs.