T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bark-send.sh:108- Finding
Bark Device Key Exposed Through Command-Line Arguments and Troubleshooting Output
- Content
View full analysis
&1) ``` The documentation also recommends printing the credential directly: ```bash 1. 检查 BARK_KEY 是否正确: `echo $BARK_KEY` ``` ### Technical Analysis The Bark device key acts as an authorization credential because anyone possessing it can submit push notifications for the associated Bark device. The shell implementation places this key inside `FULL_URL`, which is passed to `curl` as a command-line argument. While `curl` is running, local users or monitoring software with sufficient process visibility may be able to inspect the URL through process listings, process telemetry, shell tracing, audit logs, or debugging tools. Supplying the key through `-k` creates an additional exposure because the key is already present in the shell script's own process arguments. The troubleshooting documentation compounds the issue by recommending `echo $BARK_KEY`, which can disclose the key through terminal recording, shell-session capture, CI logs, support transcripts, or screen sharing. The request uses HTTPS, so this finding does not imply that the key is transmitted in plaintext over the network. The exposure occurs locally and in operational logs. ### Attack Path 1. A user invokes the shell script with `BARK_KEY` configured or supplies the key through `-k`. 2. The script embeds the key in `https://api.day.app/${DEVICE_KEY}`. 3. The complete URL is passed as an argument to the `curl` process. 4. A local observer, process-monitoring agent, or log collector captures ...[truncated 829 chars]- Remediation
View remediation