T09 · Insecure Skill Coding Practices
Warning
- Location
- bin/run.mjs:28
- Finding
- API Token Exposed Through URL Query Parameters and Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `bin/run.mjs:28-35, 69-77, 166-169, 200-210, 225-234`; `SKILL.md:37` **Vulnerability Type**: Credential exposure through insecure token transport **Risk Level**: Medium ### Vulnerable Code The operation declares the authentication token as a query parameter: ```js { "defaultValue": null, "description": "User authentication token.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" } ``` The supplied token is inserted into the parameter object: ```js function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` All query parameters, including `token`, are appended to the request URL: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.append(name, String(value)); } ``` The resulting URL is transmitted to the declared API endpoint: ```js const baseUrl = manifest.baseUrl; const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); const requestInit = { headers: { "accept": "application/json", ...[truncated 3194 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Move authentication out of the query string.** If supported by JustOneAPI, send the token in an HTTP authorization header: ```js const token = process.env.JUST_ONE_API_TOKEN; if (!token) { fail("JUST_ONE_API_TOKEN is required."); } const requestInit = { headers: { accept: "application/json", authorization: `Bearer ${token}`, }, method: operation.method, }; ``` 2. **Read the token directly from the environment.** Remove the `--token` command-line option so the credential is not included in the child process argument vector. 3. **Update the API schema and generated artifacts.** Change the authentication definition from a query parameter to an OpenAPI security scheme, then regenerate `bin/run.mjs`, `generated/operations.json`, and `generated/operations.md`. 4. **Prevent accidental logging.** Ensure request logging, exception handling, tracing, and telemetry redact `Authorization`, `token`, and other credential-bearing values. 5. **If the upstream API only accepts query authentication**, document this limitation explicitly and apply compensating controls: - Disable or redact query-string logging at gateways and proxies. - Avoid including the final URL in diagnostics. - Use narrowly scoped, short-lived tokens where available. - Rotate tokens regularly and immediately after suspected exposure. 6. **Rotate potentially exposed credentials.** Tokens previously used through this helper should be rotated if process metadata or URL logs may have been accessible to untrusted parties. ]]>