T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:76- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:76-77, 104-106; affected call sites includesrc/api/comment.js:20-23, 46-50,src/api/detail.js:20-23, 46-50,src/api/post.js:20-23, 46-50, andsrc/api/search.js:23-26, 52-59
Vulnerability Type: Sensitive credential exposure through URL query parameters
Risk Level: MediumComplete Code Snippet
The affected API modules include the credential in parameter objects:
js return await postJson( "/api/xiaohongshu/comment/url", { _: Date.now(), token: token }, { url, limit }, );js const res = await getJson("/api/xiaohongshu/comment/info", { _: Date.now(), token: token, url, limit, });The shared request implementation serializes those parameters into the request URL:
js params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data);js const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Content-Type": "application/json", }, };Equivalent token-bearing parameter objects are used by the detail, post, and search API modules.
Technical Analysis
GUAIKEI_API_TOKENis an authentication credential. Every command reads it from the environment and passes it to the API layer, where it is included as thetokenquery parameter. The shared transport then constructs a request target resembling:text /api/xiaohongshu/comment/info?token=<credential>&url=<value>&limit=<value>HTTPS protects the request target while it travels over the network, but it does not prevent the URL from being recorded at HTTPS termination points or within server-side infrastructure. Reverse proxies, API gateways, web servers, observability platforms, and access logs commonly retain complete request targets. Query parameters may also receive weaker redaction treatment than authorizat ...[truncated 1491 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove
tokenfrom every query-parameter object in:src/api/comment.jssrc/api/detail.jssrc/api/post.jssrc/api/search.js
-
Transmit the credential through a standard authorization header:
js headers: { "Content-Type": "application/json", "Authorization": `Bearer ${token}`, }A dedicated secret header such as
X-API-Keyis also acceptable if required by the server protocol.-
Refactor
postJson()andgetJson()so authentication is passed separately from ordinary query parameters. This reduces the risk that future call sites accidentally serialize credentials into URLs. -
Configure proxies, gateways, application servers, and observability systems to redact authorization headers and sensitive query parameters.
-
Review existing request logs for token-bearing URLs. Restrict access, securely delete retained copies where permitted, and rotate all potentially exposed credentials.
-
Add automated tests that fail if generated request paths contain
token,api_key,authorization, or other credential fields. -
Document token rotation, expiration, least-privilege scope, and incident-response procedures.
-