T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:538- Finding
API Credential Exposed Through Command-Line Arguments and URL Query Parameters
- Content
View full analysis
" --token "$JUST_ONE_API_TOKEN" --params-json '{"key":"value"}' ``` The runner copies that command-line value into the operation parameters: ```javascript function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` All query parameters, including `token`, are then appended to the request URL: ```javascript function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` ### Technical Analysis The Skill requires a JustOneAPI access token for its declared API functionality. Sending authentication information to the fixed HTTPS endpoint is therefore functionally necessary, and the reviewed code does not indicate covert exfiltration to an unrelated destination. However, the selected credential-transport mechanisms create avoidable disclosure risks: 1. Expanding `JUST_ONE_API_TOKEN` into `--token` places the credential in the process argument vector. Depending on operating-system permissions and monitoring configuration, command arguments may be visible through process inspection, shell auditing, job runners, diagnostic ...[truncated 2232 chars]- Remediation
View remediation
" \ --params-json '{"key":"value"}' ``` Preferably, configure the environment outside command history rather than assigning the token inline. 5. If the upstream API only supports query-string authentication: - Continue restricting requests to the fixed HTTPS origin. - Disable redirects or verify every redirect destination before following it. - Ensure URLs are never included in application errors or diagnostic output. - Configure proxies, gateways, and observability systems to redact the `token` parameter. - Use short-lived, narrowly scoped tokens with rate limits. - Provide immediate token rotation and revocation capabilities. 6. Add automated tests confirming that credentials never appear in stdout, stderr, exceptions, request diagnostics, or process arguments. ]]>