T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:151- Finding
API Credential Exposed Through Process Arguments and URL Query Parameters
- Content
View full analysis
"}' ``` The token is copied from the command-line argument into the request parameters: ```js function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` It is then serialized into the URL query string: ```js function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.append(name, String(value)); } ``` ### Technical Analysis Passing secrets through command-line arguments can expose them to process inspection, shell or execution telemetry, debugging tools, and process-monitoring systems, depending on the operating-system configuration and trust boundaries. Placing the token in the URL query string creates an additional exposure surface. Although HTTPS protects the URL in transit from passive network observers, the complete URL may still be retained by the API server, reverse proxies ...[truncated 2066 chars]- Remediation
View remediation