T09 · Insecure Skill Coding Practices
Warning
- Location
- skill/scripts/search.sh:31
- Finding
- Zhipu API Key Exposed in Process Command-Line Arguments## Vulnerability Details **File Location**: `skill/scripts/search.sh:31-34`; insecure usage examples also appear in `SKILL.md:41-47` and `skill/SKILL.md:41-47` **Vulnerability Type**: Credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code `skill/scripts/search.sh:31-34`: ```bash RESULT=$(curl -s --proto =https --tlsv1.2 -m 30 -X POST "https://open.bigmodel.cn/api/paas/v4/embeddings" \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d "$PAYLOAD") ``` `SKILL.md:41-47` and `skill/SKILL.md:41-47`: ```bash curl -s -X POST "https://open.bigmodel.cn/api/paas/v4/chat/completions" \ -H "Authorization: Bearer $ZHIPU_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "glm-4-flash", "messages": [{"role": "user", "content": "搜索: YOUR_QUERY"}], "tools": [{"type": "web_embeddings", "web_embeddings": {"embeddings_query": "YOUR_QUERY"}}] }' | jq -r '.choices[0].message.content' ``` ### Technical Analysis The API key is expanded directly into the `curl` authorization-header argument. Consequently, the complete bearer token becomes part of the process command line for the lifetime of the request. Depending on operating-system process visibility controls, other local users, privileged monitoring agents, process supervisors, diagnostic tooling, or command-line logging systems may be able to observe and retain the token. Both skill instruction files explicitly note that the key may be visible through process inspection, confirming that this exposure is an expected consequence of the implementation rather than a theoretical code path. The use of HTTPS protects the credential in transit but does not prevent local command-line disclosure. ### Attack Path 1. A victim configures `ZHIPU_API_KEY` and invokes `skill/scripts/search.sh`. 2. The script expands the key into the argument `Authorization: Bearer <key>`. 3. Whi ...[truncated 996 chars]
- Remediation
- ## Remediation Suggestions - Do not interpolate bearer tokens into command-line arguments. - Provide the authorization header through a protected temporary curl configuration or header file with permissions set to `0600`, and remove it immediately after use with a reliable cleanup trap. - Prefer a supported credential mechanism that keeps secret values out of process arguments, environment dumps, logs, and shell history. - Run the skill under a dedicated account and restrict process inspection between users where the operating system supports it. - Disable command-line capture or apply credential redaction in process supervisors, observability agents, and diagnostic tooling. - Use a narrowly scoped Zhipu key with minimal permissions, usage limits, and regular rotation. - Update both `SKILL.md` files so their examples use the hardened credential-handling method rather than reproducing the insecure pattern. - Revoke and replace any key suspected of having been exposed through process monitoring.