T09 · Insecure Skill Coding Practices
- Location
scripts/google_shopping.py:144- Finding
API Token Exposure Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/google_shopping.py, lines 144 and 447–452
Vulnerability Type: API credential exposure through process arguments and unnecessary environment mutation
Risk Level: MediumVulnerable Code
python parser.add_argument("--token", help="Dataify API token. Bearer prefix is optional.")python def get_authorization(token_arg: str | None) -> str | None: token = clean_value(token_arg) or clean_value(os.environ.get("DATAIFY_API_TOKEN")) if not token: return None if not token.lower().startswith("bearer "): token = f"Bearer {token}" os.environ["DATAIFY_API_TOKEN"] = token return tokenTechnical Analysis
The script accepts a Dataify API token through the
--tokencommand-line argument. Credentials passed this way can be exposed in shell history, process listings, CI/CD logs, terminal recordings, command telemetry, and diagnostic reports.The
get_authorizationfunction also writes the normalized bearer credential back toDATAIFY_API_TOKEN. This mutation is unnecessary because the value can be returned directly to the request function. It increases the credential's exposure within the process environment and may make it accessible to subsequently launched child processes if the implementation is extended.Sending the authorization token to the fixed HTTPS endpoint
https://scraperapi.dataify.com/requestis necessary for the declared API-client functionality and is documented by the Skill. The vulnerability is therefore not the authorized network transmission itself, but the insecure optional mechanism for supplying and retaining the credential locally.Attack Path
- A user or automation system invokes the script using a command such as:
bash python3 scripts/google_shopping.py --token SECRET_TOKEN --q "wireless headphones" - The complete command, including
SECRET_TOKEN, is ...[truncated 1045 chars]
- A user or automation system invokes the script using a command such as:
- Remediation
View remediation
Remediation Suggestions
- Remove the
--tokenargument and accept the credential only throughDATAIFY_API_TOKENor another protected secret-delivery mechanism. - Do not write the normalized bearer token back into
os.environ; normalize it in a local variable and return it directly. - If command-line token support must temporarily remain for compatibility:
- Mark it as deprecated.
- Emit a warning that command-line arguments may be logged or visible to other local users.
- Ensure documentation and examples never recommend it.
- For interactive use where environment variables are unsuitable, read the token without terminal echo using
getpass.getpass(). - Configure CI/CD systems to inject the token through their protected secret facilities and mask it in logs.
- Rotate any token that may previously have been passed on the command line or captured in logs.
- Keep previews limited to indicating whether a token is present; never print any portion of the credential.
- Remove the