T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:21- Finding
API Key Exposed Through Command-Line Arguments and Shell History
- Content
View full analysis
', 'API key for Xinhua Finance API'); ``` The documented invocation explicitly places the credential in a command-line argument: ```bash xhcj-finance --api-key market --symbol ``` ### Technical Analysis The CLI accepts sensitive API credentials through the `--api-key` command-line option. Depending on the operating system and shell configuration, command-line arguments may be exposed through: - Shell history files. - Process inspection utilities and process metadata. - Monitoring, diagnostics, or endpoint telemetry. - Terminal logs and copied command output. - Wrapper scripts or CI job logs. The implementation subsequently hashes the supplied value using MD5 and clears the JavaScript variable, but those operations do not remove copies already stored in process arguments, shell history, or external telemetry. There is also a correctness defect at `index.js:28-37` and `index.js:229`: `program.opts()` is called before `program.parse(process.argv)`. As a result, the current implementation normally fails to retrieve the provided key and rejects requests as unauthenticated. This limits normal API use but does not prevent the plaintext key from appearing in the invoking shell's history or the process command line. ### Attack Path 1. A user follows the documented instructions and invokes the CLI with a valid plaintext API key: ```bash xhcj-finance --api-key xhcj_ market --symbol 600000.SS ``` 2. The shell records the complete command in its history, or the operating system exposes it ...[truncated 945 chars]- Remediation
View remediation