T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:27- Finding
API Token Exposed Through Process Arguments and URL Query Parameters
- Content
View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` All query parameters, including the token, are appended to the request URL: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The documented invocation also supplies the secret through a command-line argument: ```bash node {baseDir}/bin/run.mjs --operation "gwApiDataSpAuthorRecVideosV2V1" --token "$JUST_ONE_API_TOKEN" --params-json '{"oAuthorId":""}' ``` ### Technical Analysis Authentication must be transmitted to the declared JustOneAPI service for this Skill to work, but the selected mechanisms expose the credential more broadly than necessary. First, passing the token through `--token` places it in the Node process argument vector. Depending on host configuration, process arguments may be visible to other local users, process-mo ...[truncated 2042 chars]- Remediation
View remediation