T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/google_maps_scraper_actor.py:132- Finding
Apify API Token Exposed Through URL Query Parameters and Command-Line Arguments
- Content
View full analysis
dict[str, Any]: params: dict[str, str | int | float] = { "token": token, "timeout": timeout_sec, "clean": "true", } if budget_usd is not None: if budget_usd <= 0: raise SkillError("--budget-usd must be > 0.") params["maxTotalChargeUsd"] = budget_usd url = ( f"https://api.apify.com/v2/acts/{urllib.parse.quote(actor_id, safe='')}/run-sync-get-dataset-items" f"?{urllib.parse.urlencode(params)}" ) ``` The CLI also accepts the credential directly: ```python common.add_argument("--apify-token", help="Apify API token (fallback: APIFY_TOKEN env)") ``` The troubleshooting documentation recommends the same insecure option: ```bash --apify-token 'apify_api_xxx' ``` ### Technical Analysis The implementation inserts `APIFY_TOKEN` into the request URL as the `token` query parameter. Although the request uses HTTPS, placing credentials in URLs increases their exposure because complete URLs may be retained by HTTP diagnostics, reverse proxies, API gateway logs, monitoring systems, exception reports, or debugging tools. The optional `--apify-token` argument creates an additional local disclosure channel. Command-line arguments can be retained in shell history and may be visible to other local users through process-inspection facilities while the process is running. The token is sent only to the declared Apify API endpoint, so the outbound authentication request is necessary for the Skill's functionality. The vulnerability is the transport location and credential-input mechanism, not the existence of the authenticated netw ...[truncated 1310 chars]- Remediation
View remediation