T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:91- Finding
API Credential Exposed Through Process Arguments and URL Query Parameters
- Content
View full analysis
","range":""}' ``` Command-line token processing in `bin/run.mjs:154-158`: ```javascript if (flag === "--token") { parsed.token = value; index += 1; continue; } ``` Request URL construction in `bin/run.mjs:91-94`: ```javascript const baseUrl = manifest.baseUrl; const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); ``` Query parameter insertion in `bin/run.mjs:212-219`: ```javascript function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The operation manifest defines `token` as a required query parameter: ```javascript { "defaultValue": null, "description": "User authentication token.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" } ``` ### Technical Analysis Supplying secrets through command-line arguments can expose them to process inspection, endpoint monitoring, command telemetry, shell tracing, debugging tools, and audit systems. Expanding `"$JUST_ONE_API_ ...[truncated 2444 chars]- Remediation
View remediation
","range":""}' ``` 7. Rotate any token that may already have been retained in shell traces, process telemetry, URL logs, proxy logs, or monitoring systems. ]]>