T09 · Insecure Skill Coding Practices
- Location
movie.py:23- Finding
API Credential Exposed in URL Query String
- Content
View full analysis
Vulnerability Details
File Location:
movie.py, lines 23–30
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumVulnerable Code:
python def _call_movie_api(url: str, appkey: str, params: dict = None): query = {"appkey": appkey} if params: for k, v in params.items(): if v not in (None, ""): query[k] = v try: resp = requests.get(url, params=query, timeout=10)Technical Analysis
The function places
JISU_API_KEYin theappkeyquery parameter of an HTTP GET request. Although all configured API endpoints use HTTPS, query strings can still be retained after TLS termination in API-provider logs, reverse-proxy access logs, observability systems, debugging output, or other URL-recording infrastructure.The endpoints are fixed to the documented
api.jisuapi.comservice, so this is not an arbitrary exfiltration mechanism. However, URL-based credential transmission increases incidental disclosure risk compared with an authorization header or protected request body.Attack Path
- A user configures a valid
JISU_API_KEYand invokes the skill. _call_movie_apiconstructs a request URL containingappkey=<credential>.- An intermediary or provider-side component records the complete request URL.
- An attacker with access to those logs or telemetry extracts the AppKey.
- The attacker submits requests to the JisuAPI service using the compromised credential.
Exploitation depends on access to infrastructure that records full URLs; no direct unauthenticated credential-disclosure path was identified within the project itself.
Impact Assessment
A compromised AppKey could allow unauthorized requests under the victim's JisuAPI account. The likely scope includes consumption of API quota, rate-limit exhaustion, possible billing impact, and access to API products authorized fo ...[truncated 146 chars]
- A user configures a valid
- Remediation
View remediation
Remediation Suggestions
- Use an authorization header if JisuAPI supports header-based authentication, for example:
python headers = {"Authorization": f"Bearer {appkey}"} resp = requests.get(url, params=params, headers=headers, timeout=10) - If the provider supports only the
appkeyquery parameter, ensure that application, proxy, monitoring, and provider logs redact the parameter value. - Never emit the prepared request URL, request configuration, or AppKey in debug and exception logs.
- Restrict the key by source address, permitted API products, quota, and spending limits where the provider supports those controls.
- Use separate keys per environment and rotate them periodically and immediately after suspected exposure.
- Continue loading the credential from the environment rather than hardcoding it in source code or documentation.
- Use an authorization header if JisuAPI supports header-based authentication, for example: