T09 · Insecure Skill Coding Practices
- Location
scripts/google_jobs.py:164- Finding
API Token Exposure Through Command-Line Arguments and Environment Reassignment
- Content
View full analysis
Vulnerability Details
File Location:
scripts/google_jobs.py, lines 164 and 437–443
Vulnerability Type: API credential exposure
Risk Level: MediumVulnerable Code
python parser.add_argument("--token", help="Dataify API token. Bearer prefix is optional.")python def get_authorization(token_arg: str | None) -> str | None: token = clean_value(token_arg) or clean_value(os.environ.get("DATAIFY_API_TOKEN")) if not token: return None if not token.lower().startswith("bearer "): token = f"Bearer {token}" os.environ["DATAIFY_API_TOKEN"] = token return tokenTechnical Analysis
The script supports passing the Dataify API token through the
--tokencommand-line option. Command-line arguments may be exposed through shell history, process inspection, endpoint telemetry, audit records, CI logs, or command logging by the invoking agent.The function then writes the normalized, bearer-prefixed credential back into
DATAIFY_API_TOKEN. This reassignment is unnecessary for making the API request and broadens the secret's presence within process state. It could expose the credential through environment diagnostics or to child processes added in future revisions.The legitimate network transmission itself is not a vulnerability: the token is required for the declared functionality and is sent in the
Authorizationheader to the fixed HTTPS endpointhttps://scraperapi.dataify.com/request. The weakness concerns how the credential can be supplied and retained locally.Attack Path
- A user or automation invokes the client with a plaintext credential:
bash python3 scripts/google_jobs.py --token SECRET --q "software engineer jobs" - The complete command is retained in shell history, process telemetry, an audit log, or an agent execution record.
- A local user, monitoring service, or log reader with access to that record obtain ...[truncated 721 chars]
- A user or automation invokes the client with a plaintext credential:
- Remediation
View remediation
Remediation Suggestions
- Remove the
--tokencommand-line option so credentials cannot be passed through process arguments. - Read the token only from
DATAIFY_API_TOKEN, a protected credential store, or a non-echoing standard-input prompt intended for interactive use. - Do not assign the normalized authorization value back to
os.environ. Keep it only in a local variable for the duration of the request. - Ensure exceptions, debug output, request tracing, and telemetry redact
AuthorizationandDATAIFY_API_TOKEN. - Document a secure setup method using a session-scoped environment variable without printing its value.
- Rotate any token previously passed on the command line if command histories or execution logs may be accessible.
- Where supported, restrict the token by scope, rate, account permissions, and lifetime to reduce the impact of disclosure.
- Remove the