T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wallhaven_download.py:146- Finding
Wallhaven API Key Exposed in Process Command-Line Arguments
- Content
View full analysis
dict: proc = subprocess.run( ["curl", "-fsSL", url], capture_output=True, text=True, check=False, ) if proc.returncode != 0: raise RuntimeError(proc.stderr.strip() or f"curl failed: {proc.returncode}") return json.loads(proc.stdout) ``` ```python parser.add_argument("--apikey", default=os.environ.get("WALLHAVEN_API_KEY", "")) ``` ```python if args.apikey and "apikey" not in params: params["apikey"] = args.apikey safe_params = dict(params) if "apikey" in safe_params: safe_params["apikey"] = "***REDACTED***" try: validate_base_url(args.base_url) except ValueError as e: print(f"[error] invalid --base-url: {e}", file=sys.stderr) return 2 out_dir = Path(args.out) out_dir.mkdir(parents=True, exist_ok=True) requested = max(args.count, 0) if requested == 0: print("downloaded=0") return 0 page = int(params.get("page", "1")) ``` ```python query = dict(params) query["page"] = str(page) url = f"{args.base_url}?{urlencode(query)}" try: payload = fetch_json(url) ``` ### Technical Analysis The API key is inserted into the request query string. The resulting URL is then supplied directly as a command-line argument to a child `curl` process. Consequently, the credential may temporarily appear in process listings, process-monitoring systems, diagnostic tooling, audit records, or telemetry that captures command-line arguments. The documented `--apikey` invocation method also exposes the credential in the parent Python process's command line. Redacting the key in `manifest.json` prevents persistent disclosure through the manifest, but does not address command-line exposure. Sending the API key to Wallhaven i ...[truncated 1251 chars]- Remediation
View remediation