T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:24- Finding
API Token Exposed Through Process Arguments and URL Query Parameters
- Content
View full analysis
"}' ``` `bin/run.mjs:24-31` defines the authentication token as a query parameter: ```js { "defaultValue": null, "description": "User authentication token.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" } ``` `bin/run.mjs:204-216` places the command-line token into the request parameters: ```js function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` `bin/run.mjs:238-247` appends every query parameter, including `token`, to the URL: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` `bin/run.mjs:89-92` then transmits the resulting URL: ```js let response; try { response = await fetch(url, requestInit); } catch (error) { ``` ### Technical Analysis The API token is exposed through two separate mechanisms: 1. **Process argument exposure:** Supplying the token through `--token` places it in the process argument vector. Depending on operating-system ...[truncated 2425 chars]- Remediation
View remediation
"}' ``` 5. If the upstream API only supports query-string authentication: - Request that the provider add header-based authentication. - Configure gateways, proxies, access logs, and observability platforms to redact the `token` parameter. - Never include complete request URLs in errors or diagnostic output. - Use narrowly scoped, short-lived, and readily revocable tokens. - Document the residual query-string credential exposure explicitly. 6. Rotate any token that may already have appeared in process telemetry, shell traces, CI logs, proxy logs, or server access logs. ]]>