T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bing_videos.py:706- Finding
API Token Exposure Through Command-Line Arguments and Environment Mutation
- Content
View full analysis
str: token = args.token or os.getenv("DATAIFY_API_TOKEN") if not token: raise MissingTokenError( "Missing DATAIFY_API_TOKEN." ) token = token.strip() if not token.lower().startswith("bearer "): token = f"Bearer {token}" os.environ["DATAIFY_API_TOKEN"] = token return token ``` ```python parser.add_argument("--token", help="API token for this run. Bearer prefix is added when missing.") ``` The displayed exception text is translated for report-language consistency; the executable source contains an equivalent localized missing-token message. ### Technical Analysis The script permits users or an agent to provide the Dataify API credential through the `--token` command-line option. Command-line arguments are not an appropriate secret transport because they may be exposed through: - Shell history files. - Process inspection utilities and operating-system process metadata. - Command telemetry, terminal logs, or agent execution logs. - Debugging and monitoring systems that capture process arguments. This command-line mechanism is unnecessary because the script already supports the documented `DATAIFY_API_TOKEN` environment variable. After resolving the token, the script also writes the normalized bearer credential back to `os.environ`. This mutation is not required to issue the request because `call_api` receives the token directly as a function argument. Any child process subsequently created by the same Python process would inherit the credential unless its environment were explicitly restricted. Although the current script does not create child processes, retaining this mutation unnecessa ...[truncated 1711 chars]- Remediation
View remediation
str: token = os.getenv("DATAIFY_API_TOKEN") if not token: raise MissingTokenError("DATAIFY_API_TOKEN is not configured.") token = token.strip() if not token.lower().startswith("bearer "): token = f"Bearer {token}" return token ``` The parser declaration for `--token` should then be removed, and the caller should invoke `resolve_token()` without passing command-line credentials. ]]>