T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/validate_relay.py:29- Finding
Relay API Key Exposed Through Command-Line Arguments
- Content
View full analysis
[api-key]", file=sys.stderr) sys.exit(2) base = sys.argv[1].rstrip("/") api_key = sys.argv[2] if len(sys.argv) > 2 else None ``` ### Technical Analysis The validator accepts the relay API key as a positional command-line argument. Command-line arguments can be exposed through shell history, process inspection utilities, operating-system audit records, job runners, and CI/CD logs. Although the key is not printed by the script itself, passing it through `sys.argv` creates unnecessary local disclosure channels. The credential subsequently authorizes access to relay polling, attachment, and send endpoints. ### Attack Path 1. An operator invokes the validator with `validate_relay.py https://relay.example API_KEY`. 2. The shell records the invocation in command history, or a local process-monitoring facility captures the process arguments. 3. Another local user, administrator, monitoring service, or person with access to automation logs retrieves the API key. 4. The exposed key is submitted to the relay's authenticated endpoints. 5. Subject to the relay's authorization policy, the attacker reads queued data, probes attachments, or submits outbound messages. ### Impact Assessment Successful exploitation exposes the privileges assigned to the relay API key. Potential scope includes reading relay messages, accessing attachment endpoints, and sending messages. This issue does not itself grant system-level privileges; impact is bounded by the relay credential's permissions and accessibility. ]]>- Remediation
View remediation