T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/google_play.py:289- Finding
API Token Exposure Through Command-Line Arguments and Process Environment Mutation
- Content
View full analysis
str | None: token = clean_value(token_arg) or clean_value(os.environ.get("DATAIFY_API_TOKEN")) if not token: return None if not token.lower().startswith("bearer "): token = f"Bearer {token}" os.environ["DATAIFY_API_TOKEN"] = token return token ``` ### Technical Analysis The script permits the Dataify API token to be supplied through the `--token` command-line argument. Command-line secrets may be retained in shell history and can be visible to local process-monitoring tools or other users with sufficient process-inspection access. After reading the credential, `get_authorization()` writes the normalized bearer credential back to `os.environ`. This mutation is unnecessary for the HTTP request and expands the credential's exposure surface. Any subsequently launched child process would inherit the modified environment by default. It also changes the variable from a raw token to an authorization-header value prefixed with `Bearer `, creating an undocumented side effect. Reading `DATAIFY_API_TOKEN` is necessary for the declared API integration, but accepting it through process arguments and rewriting it into the environment exceed the minimum credential-handling behavior needed to perform the request. ### Attack Path 1. A user runs the script with `--token SECRET`. 2. The token is recorded in shell history or exposed through process argument inspection while the process is active. 3. The script writes `Bearer SECRET` into `DATAIFY_API_TOKEN`. 4. A local process with environment-inspection privileges, or a child process launched later in the same process context, obtains the ...[truncated 712 chars]- Remediation
View remediation
str | None: token = clean_value(os.environ.get("DATAIFY_API_TOKEN")) if not token: return None return token if token.lower().startswith("bearer ") else f"Bearer {token}" ``` 6. Document that credentials should be set through session-scoped environment configuration and should never be passed directly in a shell command. ]]>