T09 · Insecure Skill Coding Practices
- Location
skill/scripts/search.sh:31- Finding
Zhipu API Key Exposed in Process Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
skill/scripts/search.sh:31-34; insecure usage examples also appear inSKILL.md:41-47andskill/SKILL.md:41-47
Vulnerability Type: Credential exposure through process arguments
Risk Level: MediumVulnerable Code
skill/scripts/search.sh:31-34:bash RESULT=$(curl -s --proto =https --tlsv1.2 -m 30 -X POST "https://open.bigmodel.cn/api/paas/v4/embeddings" \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d "$PAYLOAD")SKILL.md:41-47andskill/SKILL.md:41-47:bash curl -s -X POST "https://open.bigmodel.cn/api/paas/v4/chat/completions" \ -H "Authorization: Bearer $ZHIPU_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "glm-4-flash", "messages": [{"role": "user", "content": "搜索: YOUR_QUERY"}], "tools": [{"type": "web_embeddings", "web_embeddings": {"embeddings_query": "YOUR_QUERY"}}] }' | jq -r '.choices[0].message.content'Technical Analysis
The API key is expanded directly into the
curlauthorization-header argument. Consequently, the complete bearer token becomes part of the process command line for the lifetime of the request.Depending on operating-system process visibility controls, other local users, privileged monitoring agents, process supervisors, diagnostic tooling, or command-line logging systems may be able to observe and retain the token. Both skill instruction files explicitly note that the key may be visible through process inspection, confirming that this exposure is an expected consequence of the implementation rather than a theoretical code path.
The use of HTTPS protects the credential in transit but does not prevent local command-line disclosure.
Attack Path
- A victim configures
ZHIPU_API_KEYand invokesskill/scripts/search.sh. - The script expands the key into the argument
Authorization: Bearer <key>. - Whi ...[truncated 996 chars]
- A victim configures
- Remediation
View remediation
Remediation Suggestions
- Do not interpolate bearer tokens into command-line arguments.
- Provide the authorization header through a protected temporary curl configuration or header file with permissions set to
0600, and remove it immediately after use with a reliable cleanup trap. - Prefer a supported credential mechanism that keeps secret values out of process arguments, environment dumps, logs, and shell history.
- Run the skill under a dedicated account and restrict process inspection between users where the operating system supports it.
- Disable command-line capture or apply credential redaction in process supervisors, observability agents, and diagnostic tooling.
- Use a narrowly scoped Zhipu key with minimal permissions, usage limits, and regular rotation.
- Update both
SKILL.mdfiles so their examples use the hardened credential-handling method rather than reproducing the insecure pattern. - Revoke and replace any key suspected of having been exposed through process monitoring.