T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/convert.cjs:208- Finding
API Key Exposed Through Command-Line Arguments
- Content
View full analysis
" })); process.exit(1); } const key = argv[0]; ``` The project documentation actively recommends placing the API key directly in the command: ```bash node scripts/convert.cjs SVG2PPTSKILL-xxx map:安徽 node scripts/convert.cjs SVG2PPTSKILL-xxx char:中 node scripts/convert.cjs SVG2PPTSKILL-xxx map:Anhui ``` ### Technical Analysis The conversion script receives the API key as its first command-line argument and retrieves it through `process.argv`. Secrets passed this way can be exposed through shell history, process inspection facilities, command telemetry, terminal session recording, diagnostic reports, or logs generated by wrapper and orchestration tools. The SVG value is also normally supplied as a command-line argument. Consequently, confidential SVG content may be exposed through the same channels. HTTPS protects the subsequent network request in transit, but it does not prevent local disclosure before the request is sent. Exploitation requires access to a relevant local observation channel, such as the victim's command history, process metadata, terminal logs, or automation telemetry. No unrelated remote exfiltration endpoint was identified in the audited code. ### Attack Path 1. A user follows the documented instructions and invokes the script with an API key in the command line. 2. The shell records the complete command in history, or a local monitoring, telemetry, wrapper, or process-inspection facility capt ...[truncated 1097 chars]- Remediation
View remediation
...' | SVG2PPT_KEY="$SVG2PPT_KEY" node scripts/convert.cjs unset SVG2PPT_KEY ``` For stronger protection, the script should read the key from a non-echoing prompt or protected file descriptor rather than exposing it in either command arguments or a broadly inspectable environment. ]]>