T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/apply-api-key.js:45- Finding
Brave API Key Exposed Through Process Command-Line Arguments
- Content
View full analysis
/scripts/apply-api-key.js "" ``` `scripts/apply-api-key.js:4-7`: ```javascript * Usage: * node apply-api-key.js * echo "BSA9..." | node apply-api-key.js --stdin ``` `scripts/apply-api-key.js:45`: ```javascript const args = process.argv.slice(2); ``` `scripts/apply-api-key.js:64-65`: ```javascript } else if (args[0]) { applyApiKey(args[0]); ``` ### Technical Analysis The documented default workflow passes the Brave API key as a positional command-line argument. The script then retrieves that credential from `process.argv`. Command-line arguments are not an appropriate secret-transfer mechanism. Depending on the host and execution environment, they may be observable through process inspection facilities, command auditing, shell history, Agent execution transcripts, monitoring software, or centralized logs. The secret must also be inserted into an Agent-generated command, contradicting the documentation's assertion that it does not pass through LLM text generation. Although the script supports standard-input ingestion through `--stdin`, the Skill documentation recommends the less secure positional-argument form, and the implementation continues to accept it. ### Attack Path 1. A user invokes the Skill while authenticated to the Brave Search API dashboard. 2. The Skill reveals and extracts the user's Brave API key. 3. Following the documented workflow, the Agent constructs a command containing the complete key as a positional argument. 4. The command is executed, placing the key in the process argument vector. 5. A local user, process-monitoring service, command-auditing system, transcript reader, or log collector with access to that data observes and records the ...[truncated 825 chars]- Remediation
View remediation
data += chunk); process.stdin.on('end', () => applyApiKey(data.trim())); ``` The calling workflow should use a protected stdin or secret-injection facility that does not embed the credential in shell source, shell history, environment-variable listings, or Agent-visible command text. ]]>