T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:18- Finding
API Authentication Token Exposed in the Request URL
- Content
View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.append(name, String(value)); } ``` ### Technical Analysis The token is inserted into `params.token`. Because the operation metadata marks `token` as a query parameter, `applyQueryParams` serializes it into a URL resembling: ```text https://api.justoneapi.com/api/facebook/get-profile-id/v1?token=&url= ``` HTTPS encrypts the URL while it tra ...[truncated 2059 chars]- Remediation
View remediation
``` Alternatively, use a provider-specific secret header such as `X-API-Key`. 2. Remove `token` from the operation's query-parameter metadata and construct the request headers separately: ```js const requestInit = { headers: { accept: "application/json", authorization: `Bearer ${args.token}`, }, method: operation.method, }; ``` 3. Do not copy credentials into the general-purpose `params` object. Keep secrets separate from user-controlled endpoint parameters to reduce accidental serialization or logging. 4. Update `generated/operations.json`, `generated/operations.md`, and `SKILL.md` so they no longer describe or rely on query-string authentication. 5. Add explicit redaction for `token`, `authorization`, and similar fields in all errors, diagnostics, traces, and telemetry. Never report the complete request URL if it could contain sensitive parameters. 6. Prefer reading the token directly from `JUST_ONE_API_TOKEN` rather than requiring it as a command-line argument, because command-line values may be visible through process inspection or shell history in some environments. 7. Rotate tokens that may previously have been captured in URL logs. Review and sanitize API gateway, proxy, server, and observability logs according to the provider's retention controls. 8. Add an automated test asserting that the generated request URL never contains `token`, while the expected authentication header is present. ]]>