T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/duplicate_checker.py:23- Finding
License API Key Exposure Through Command-Line Arguments and External Transmission
- Content
View full analysis
tuple[bool, str]: if not api_key: return False, "FREE" try: req = urllib.request.Request( VERIFY_URL, method="POST", headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json" }, data=b"{}", ) with urllib.request.urlopen(req, timeout=10) as resp: data = json.loads(resp.read().decode("utf-8")) ``` ```python api_key = "" if len(sys.argv) > 3: arg3 = sys.argv[3] if arg3.startswith("inv-") or arg3.startswith("IN"): api_key = arg3 else: tier_data = json.loads(arg3) monthly_count = tier_data.get("monthly_count", 0) api_key = tier_data.get("api_key", "") if len(sys.argv) > 4 and not api_key: api_key = sys.argv[4] tier = TierConfig.from_api_key(api_key, monthly_count) ``` ### Technical Analysis The script accepts a license API key directly through command-line arguments and sends it as a bearer token to the vendor-controlled `api.yk-global.com` endpoint. External license validation is related to the declared tier-control functionality and does not, by itself, exceed the functional privilege requirements. However, command-line arguments are not an appropriate secret transport mechanism. Depending on the operating environment, arguments may be exposed through: - Process inspection tools such as `ps`. - Shell history. - Process telemetry and audit logging. - Container or orchestration diagnostics. - Parent-process logs and error reports. The network request uses HTTPS, and the audited code does not send invoice records in this request. Never ...[truncated 1027 chars]- Remediation
View remediation