T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/wait_for_task.py:33
- Finding
- API Token Exposed in URL Query Parameters<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wait_for_task.py`, lines 33–66, 97–105, and 124–132 **Vulnerability Type**: Credential exposure through URL query strings **Risk Level**: Medium **Category**: T09: Insecure Skill Coding Practices ### Vulnerable Code ```python def request_json(endpoint, params, api_key, timeout): url = endpoint + "?" + urllib.parse.urlencode(params) request = urllib.request.Request(url, method="GET") try: with urllib.request.urlopen(request, timeout=timeout) as response: content = response.read() charset = response.headers.get_content_charset() or "utf-8" text = content.decode(charset, errors="replace") except urllib.error.HTTPError as exc: detail = exc.read().decode("utf-8", errors="replace") normalized = detail.lower() if "credit" in normalized or "balance" in normalized or "余额" in detail or "积分" in detail: raise RuntimeError( "Dataify account has insufficient credits. Review balance or recharge at {}.".format(ACCOUNT_URL) ) if exc.code in (401, 403): raise RuntimeError( "DATAIFY_API_TOKEN was rejected. Review or rotate the API key at {}; a new registration is not required.".format( ACCOUNT_URL ) ) raise RuntimeError(detail or "HTTP {}".format(exc.code)) except urllib.error.URLError as exc: raise RuntimeError("Request failed: {}".format(exc.reason)) if api_key: text = text.replace(api_key, "<redacted>") try: return json.loads(text) except ValueError: raise RuntimeError("Dataify returned a non-JSON response") ``` The API token is supplied to this function as a query parameter: ```python payload = request_json( STATUS_ENDPOINT, {"api_key": api_key, "task_id": task_id}, api_key, request_timeout, ) ``` The same behavior occurs when downl ...[truncated 2045 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Move the API token into an authorization header: ```python request = urllib.request.Request( url, headers={"Authorization": "Bearer {}".format(api_key)}, method="GET", ) ``` 2. Keep only non-secret values such as `task_id` and `type` in the query string. 3. If the Dataify API currently requires `api_key` in the URL, request or adopt a header-based authentication endpoint before distributing the Skill. 4. Configure server, proxy, and application logging to redact legacy `api_key` parameters. 5. Ensure exceptions and diagnostic output never include request headers or complete URLs containing credentials. 6. Rotate tokens that may already have appeared in request logs and review associated account usage. ]]>