T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/notify.sh:98- Finding
Notification service credentials exposed through command-line arguments and request URLs
- Content
View full analysis
/dev/null || error "gotify request failed" ``` ```bash telegram) [[ -z "$BOT_TOKEN" || -z "$CHAT_ID" ]] && error "--bot-token and --chat-id required for telegram" curl -sf -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ -d "chat_id=${CHAT_ID}" -d "text=${MESSAGE}" -d "parse_mode=HTML" >/dev/null || error "telegram request failed" ``` ```bash pushover) [[ -z "$APP_TOKEN" || -z "$USER_KEY" ]] && error "--app-token and --user-key required for pushover" curl -sf \ --form-string "token=${APP_TOKEN}" \ --form-string "user=${USER_KEY}" \ --form-string "message=${MESSAGE}" \ --form-string "title=${TITLE:-Notification}" \ --form-string "priority=$(pushover_priority "$PRIORITY")" \ https://api.pushover.net/1/messages.json >/dev/null || error "pushover request failed" ``` The documentation encourages callers to provide credentials directly as arguments: ```bash scripts/notify.sh --channel gotify --url https://gotify.local --token TOKEN --message "Deploy done" scripts/notify.sh --channel telegram --bot-token BOT:TOK --chat-id 12345 --message "Hello" scripts/notify.sh --channel pushover --app-token X --user-key Y --message "Alert" --priority high ``` ### Technical Analysis Sensitive Gotify, Telegram, and Pushover credentials are accepted through command-line options. Such values can remain in interactive shell history and may be visible to local ...[truncated 2023 chars]- Remediation
View remediation