T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:369- Finding
API Token Exposed Through Process Arguments and URL Query Parameters
- Content
View full analysis
" --token "$JUST_ONE_API_TOKEN" --params-json '{"key":"value"}' ``` `bin/run.mjs:369-372`: ```js if (flag === "--token") { parsed.token = value; index += 1; continue; } ``` `bin/run.mjs:403-411`: ```js function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` `bin/run.mjs:446-465`: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.append(name, String(value)); } ``` ### Technical Analysis The documented invocation expands `JUST_ONE_API_TOKEN` into the Node.js process argument vector. On systems where process metadata is visible to other users, monitoring agents, container administrators, or diagnostic tools, the token may be captured while the process is running or from recorded process telemetry. The helper subsequently assi ...[truncated 1993 chars]- Remediation
View remediation
" \ --params-json '{"key":"value"}' ``` Prefer setting the variable through a protected runtime secret store rather than inline shell syntax, because inline environment assignments may also be retained in shell or orchestration telemetry. ]]>