T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:228- Finding
API Credential Exposure Through Command-Line Arguments and URL Query Parameters
- Content
View full analysis
"}' ``` The executable injects that credential into the request parameters: ```js const params = parseParams(args.paramsJson); applyDefaults(operation, params); injectToken(operation, params, args.token); validateRequired(operation, params); ``` The manifest defines `token` as a query parameter, and all defined query parameters are appended to the URL: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` Consequently, the authentication token is exposed in two sensitive contexts: 1. The `--token` value may be visible to other local users or monitoring tools through process-command-line inspection. 2. The token becomes part of the HTTPS request URL. TLS protects the URL in transit, but the complete URL may still be retained by application telemetry, reverse proxies, gateways, debugging tools, browser-like network instrumentation, or server access logs. The network request itself is necessary for the declared API-wrapper functionality and is restricted to the hard-coded HTTPS origin `api.justoneapi.com`. The unnecessary risk is the credential transport mechanism rather than the existence of the network request. ### Attack Path 1. A user invokes the documented command with a valid value in `JUST_ONE_API_TOKEN`. 2. Shell expansion places the cr ...[truncated 1348 chars]- Remediation
View remediation