T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/google_finance.py:159- Finding
API Token Exposure Through Command-Line Arguments
- Content
View full analysis
str | None: token = clean_value(token_arg) or clean_value(os.environ.get("DATAIFY_API_TOKEN")) if not token: return None if not token.lower().startswith("bearer "): token = f"Bearer {token}" os.environ["DATAIFY_API_TOKEN"] = token return token ``` ```python authorization = get_authorization(args.token) if not authorization: print("缺少 Dataify API token，请提供 token，或前往 https://dashboard.dataify.com/login?utm_source=skill 注册获取；新账号注册即得 50 免费积分。", file=sys.stderr) return 2 ``` ### Technical Analysis The script accepts the Dataify API token through the `--token` command-line option. Secrets supplied in command-line arguments may become visible through process inspection interfaces, process-monitoring software, diagnostic telemetry, command histories, CI/CD logs, or Agent execution logs. The script already supports the comparatively safer `DATAIFY_API_TOKEN` environment variable, so accepting the same credential through a command-line argument is not necessary for the declared Google Finance functionality. The token is not sent to an arbitrary destination: it is used as the `Authorization` header for the fixed HTTPS endpoint `https://scraperapi.dataify.com/request`. Consequently, the identified vulnerability concerns local credential exposure rather than hidden network exfiltration. The assignment of the normalized bearer token back into `os.environ` also unnecessarily expands its availability to any child process launched later in the same process context, although this script currently does not launch subprocesses. ...[truncated 1339 chars]- Remediation
View remediation