T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/google_videos.py:143- Finding
API Token Exposure Through Command-Line Arguments
- Content
View full analysis
str | None: token = clean_value(token_arg) or clean_value(os.environ.get("DATAIFY_API_TOKEN")) if not token: return None if not token.lower().startswith("bearer "): token = f"Bearer {token}" os.environ["DATAIFY_API_TOKEN"] = token return token ``` ### Technical Analysis The script permits the complete Dataify API token to be supplied using the `--token` command-line option. Command-line arguments are not an appropriate secret transport mechanism because they may be exposed through: - Operating-system process inspection utilities. - Shell command history. - Agent execution traces and debugging output. - Terminal session recording. - Process monitoring or audit infrastructure. The safer `DATAIFY_API_TOKEN` environment-variable path is already supported, so accepting the token through a command-line argument is not necessary for the declared Google Videos search functionality. The function also writes the normalized token back into `os.environ`. This mutation is unnecessary because the normalized token can be passed directly to the request function. Although this does not persist the token outside the process by itself, it increases the number of places inside the process from which child code or subsequently invoked libraries could retrieve the credential. ### Attack Path 1. A user or agent invokes the script using a command such as: ```bash python3 scripts/google_videos.py --token SECRET_TOKEN --q "electric cars" ``` 2. The complete token becomes part of the process command line. 3. A local user, monitoring proce ...[truncated 644 chars]- Remediation
View remediation