T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:94- Finding
API Token Exposed Through Process Arguments and URL Query Parameters
- Content
View full analysis
"}' ``` `bin/run.mjs:94-96` injects that token into the request parameters: ```js const params = parseParams(args.paramsJson); applyDefaults(operation, params); injectToken(operation, params, args.token); ``` `bin/run.mjs:113` sends the constructed URL to the external API: ```js response = await fetch(url, requestInit); ``` `bin/run.mjs:209-217` adds every query parameter—including the API token—to the URL: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The operation manifest defines `token` as a required query parameter. Consequently, this flow constructs a request resembling: ```text https://api.justoneapi.com/api/douban/get-movie-reviews/v1?token=SECRET&subjectId=... ``` ### Technical Analysis The token is exposed through two separate channels: 1. **Process argument exposure:** Supplying the token with `--token` places it in the process command line. Depending on operating-system configuration and execution environment, command lines can be visible through process inspection, shell history, audit telemetry, job runners, diagnostic tooling, or orchestration metadata. 2. **URL exposure:** The token is serialized into the URL query string. HTTPS protects the request in transit, but query strings ma ...[truncated 2293 chars]- Remediation
View remediation