T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:62- Finding
API Credential Exposed Through Command-Line Arguments and URL Query Parameters
- Content
View full analysis
"}' ``` `bin/run.mjs:62-79` reads the command-line token, inserts it into the request parameters, constructs the URL, and sends the request: ```js const args = parseArgs(process.argv.slice(2)); if (!args.operation) { fail("Missing required --operation argument."); } const operation = manifest.operations.find((item) => item.operationId === args.operation); if (!operation) { fail(`Unknown operation "${args.operation}".`, { availableOperations: manifest.operations.map((item) => item.operationId) }); } const params = parseParams(args.paramsJson); applyDefaults(operation, params); injectToken(operation, params, args.token); validateRequired(operation, params); const baseUrl = manifest.baseUrl; const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); const requestInit = { headers: { "accept": "application/json", }, method: operation.method, }; ``` `bin/run.mjs:134-152` accepts the credential through `--token`: ```js function parseArgs(argv) { const parsed = { operation: null, paramsJson: "{}", token: null }; for (let index = 0; index < argv.length; index += 1) { const flag = argv[index]; const value = argv[index + 1]; if (flag === "--operation") { parsed.operation = value; index += 1; continue; } if (flag === "--params-json") { parsed.paramsJson = value; index += 1; continue; ...[truncated 3447 chars]- Remediation
View remediation
"}' ``` If the variable is already exported, it does not need to be repeated on the command line. 5. **Apply defense-in-depth redaction.** Ensure request URLs, headers, errors, tracing data, and telemetry redact authentication values. Never include credentials in error payloads. 6. **If the upstream API only supports query authentication, document the residual risk.** Disable full-URL logging where possible, configure proxies and observability systems to redact the `token` parameter, use short-lived and narrowly scoped tokens, and rotate any token suspected of appearing in logs or process-monitoring records. ]]>