T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:34- Finding
API Key Exposed Through Process Command-Line Arguments
- Content
View full analysis
/cmdline`. Silent mode does not protect the credential because `curl -s` only suppresses progress and error output; it does not conceal process arguments. The same insecure authentication pattern is repeated across the endpoint examples, increasing the likelihood that agents will use it directly. ### Attack Path 1. A legitimate user or agent invokes one of the documented curl commands. 2. The shell expands `$MOON_BANKING_API_KEY` into the curl command-line argument. 3. While curl is running, a local process or user with sufficient process-inspection permissions enumerates active processes. 4. The attacker reads curl's argument vector and extracts the bearer credential from the `Authorization` header. 5. The attacker reuses the key to authenticate re ...[truncated 831 chars]- Remediation
View remediation
&2 exit 1 fi printf 'Authorization: Bearer %s\n' "$MOON_BANKING_API_KEY" | curl --silent --show-error --fail-with-body \ -H @- \ "https://api.moonbanking.com/v1/ENDPOINT?param=value&another=val" | jq . ``` Apply this safer pattern to every request example in `SKILL.md`. In addition: 1. Ensure diagnostic output never prints the API key or complete authorization header. 2. Use a dedicated, least-privileged API key when the service supports scoped credentials. 3. Rotate any credential suspected of having been exposed. 4. Avoid enabling shell tracing with `set -x` while handling the key. 5. Keep the key only in protected runtime secret storage and do not persist it in command history, logs, source files, or temporary files. 6. Document revocation and rotation procedures for compromised credentials. ]]>