T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/sonarr.sh:21
- Finding
- Sonarr API Key Exposed Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/sonarr.sh`, lines 21-29; the same pattern is used by subsequent `curl` commands throughout the script **Vulnerability Type**: Exposure of credentials through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash API="$SONARR_URL/api/v3" AUTH="X-Api-Key: $SONARR_API_KEY" cmd="$1" shift || true case "$cmd" in search) query="$1" curl -s -H "$AUTH" "$API/series/lookup?term=$(echo "$query" | jq -sRr @uri)" | jq -r ' ``` The `AUTH` variable containing the Sonarr API key is passed to `curl` through the `-H` command-line option. This pattern is also present at lines 38, 42, 51, 54, 70, 78, 83, 104, 131, and 143. ### Technical Analysis When a secret is supplied as a command-line argument, it becomes part of the spawned process's argument vector. Depending on operating-system process visibility, `/proc` permissions, container configuration, monitoring tools, and the privileges of local users, another process may be able to observe a command resembling: ```text curl -s -H X-Api-Key: <secret> http://localhost:8989/api/v3/... ``` Although the exposure window is limited to the lifetime of each `curl` process, the script makes multiple requests and may be invoked repeatedly. Process-monitoring or audit infrastructure may also retain command-line arguments after the process exits. Reading the dedicated configuration file at `~/.clawdbot/credentials/sonarr/config.json` is necessary for the Skill's declared functionality and does not itself exceed least privilege. The reviewed code does not access unrelated credential paths or transmit the key to an unrelated destination. The weakness is specifically the method used to transfer that key from the script to `curl`. ### Attack Path 1. The user invokes a command such as `search`, `config`, `add`, or `remove`. 2. The script reads the Sonarr API key from the dedicated configuration file. 3. It constructs the `AUTH` variable containing th ...[truncated 1329 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Avoid placing the API key in `curl` command-line arguments. Supply sensitive `curl` configuration through standard input, for example: ```bash sonarr_curl() { curl --silent --config - "$@" <<EOF header = "X-Api-Key: $SONARR_API_KEY" EOF } ``` Replace calls such as: ```bash curl -s -H "$AUTH" "$API/series" ``` with: ```bash sonarr_curl "$API/series" ``` Carefully preserve required methods, request bodies, and content-type headers when adapting POST and DELETE operations. 2. If a temporary configuration file must be used, create it with restrictive permissions, keep it outside shared directories, and remove it reliably: ```bash umask 077 config_file=$(mktemp) trap 'rm -f "$config_file"' EXIT ``` Standard input is preferable because it avoids persisting the key on disk. 3. Validate the credential file's ownership and permissions before reading it. Document and enforce restrictive permissions: ```bash chmod 600 ~/.clawdbot/credentials/sonarr/config.json ``` 4. Avoid printing the API key in errors, debugging output, shell tracing, or logs. Ensure the script is not run with `set -x` while credentials are loaded. 5. Restrict Sonarr's network exposure to trusted interfaces and rotate the API key if process monitoring or logs may already have captured it. ]]>