T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:21- Finding
API Token Exposed Through Command-Line Arguments and URL Query Parameters
- Content
View full analysis
" --token "$JUST_ONE_API_TOKEN" --params-json '{"key":"value"}' ``` `bin/run.mjs:21-29`: ```js { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" } ``` `bin/run.mjs:197-203`: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The query value is ultimately appended to the request URL: ```js function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.append(name, String(value)); } ``` ### Technical Analysis The network request is part of the declared functionality and is restricted to the fixed HTTPS origin `https://api.justoneapi.com`; therefore, the transmission is not evidence of covert exfiltration. However, the credential transport mechanism is insecure. Supplying the token with `--token` places the expanded secret in the Node.js process argument vector. Depending on the operating system and process isolation settings, command-line arguments may be visible to other local users, monitoring agents, process inspection tools ...[truncated 2054 chars]- Remediation
View remediation