T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/hienergy_skill.py:1651- Finding
API Key Exposed Through Command-Line Arguments
- Content
View full analysis
1: api_key = sys.argv[1] else: api_key = os.environ.get('HIENERGY_API_KEY') if not api_key: print("Usage: python hienergy_skill.py ") print("Or set HIENERGY_API_KEY environment variable") ``` ### Technical Analysis The script accepts the HiEnergy API key as a positional command-line argument and explicitly recommends this invocation through its usage message. Command-line arguments are not an appropriate channel for secrets because they may be exposed through: - Shell command history. - Process inspection utilities and operating-system process metadata. - Process accounting and endpoint-monitoring products. - CI/CD command logs. - Terminal session recording and diagnostic collection. Although the script also supports an environment variable, the positional argument takes precedence and the displayed usage encourages users to expose the credential. ### Attack Path 1. A user follows the displayed instruction and runs: ```bash python scripts/hienergy_skill.py ``` 2. The command, including the key, is retained in shell history or process-monitoring data. 3. Another local user, administrator, monitoring agent, support operator, or log reader obtains the argument. 4. The exposed key is replayed against `https://app.hienergy.ai/api/v1`. 5. The attacker receives the same API permissions and data access assigned to the compromised HiEnergy account. This path requires access to local process information, history, or collected logs; it does not provide remote code execution by itself. ### Impact Assessment A recovered key can authorize access to the account-scoped HiEnergy API. Depending on the compromised account's server-side privileges, this can expose adverti ...[truncated 347 chars]- Remediation
View remediation