T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:171- Finding
API Token Exposed Through Command-Line Arguments and URL Query Parameters
- Content
View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } function validateRequired(operation, params) { const missing = []; for (const parameter of operation.parameters) { if (parameter.required && params[parameter.name] === undefined) { missing.push(parameter.name); } } if (operation.requestBody?.required && params.body === undefined) { missing.push("body"); } ``` `bin/run.mjs:214-222`: ```javascript function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The manifest used by the executable defines the token as a query parameter: ```javascript { "defaultValue": null, "description": "User authentication token.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" } ``` `SKILL.md:46` documents invocation through a command-line argument: ```bash node {baseDir}/bin/run.mjs --operation "gwApiDataSpAuthorVideoDistributionV1" --token "$JUST_ONE_API_TOKEN" --params-json '{"oAuthorId":""}' ``` ### Technical Analysis The API token is first supplied through the `--token` command-line argument and then inser ...[truncated 2821 chars]- Remediation
View remediation