T09 · Insecure Skill Coding Practices
Warning
- Location
- bin/run.mjs:30
- Finding
- API Token Exposed Through Process Arguments and URL Query Parameters## Vulnerability Details **File Location**: `bin/run.mjs:30-37, 75-78, 192-202, 224-245`; related usage and schema declarations in `SKILL.md:44-49`, `generated/operations.json:14-22`, and `generated/operations.md:20` **Vulnerability Type**: Credential exposure through command-line arguments and URL query parameters **Risk Level**: Medium ### Vulnerable Code `bin/run.mjs:30-37` declares the access token as a query parameter: ```js { "defaultValue": null, "description": "Access token for the API service.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" } ``` `bin/run.mjs:75-78` adds all query parameters, including the token, to the request URL: ```js const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); ``` `bin/run.mjs:192-202` copies the command-line token into the request parameters: ```js function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` `bin/run.mjs:224-245` serializes the token into the URL query string: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(va ...[truncated 3706 chars]
- Remediation
- ## Remediation Suggestions 1. **Read the token directly from the environment** - Replace the `--token` requirement with `process.env.JUST_ONE_API_TOKEN`. - Avoid expanding the credential into the command-line argument vector. - If a CLI override must remain available, clearly mark it as insecure and disable it by default. 2. **Move authentication out of the URL** - Prefer an HTTP authorization header, for example: ```js const token = process.env.JUST_ONE_API_TOKEN; if (!token) { fail("JUST_ONE_API_TOKEN is required."); } const requestInit = { headers: { accept: "application/json", authorization: `Bearer ${token}`, }, method: operation.method, }; ``` - Remove `token` from the query-parameter manifest and ensure it is never passed to `URLSearchParams`. - Confirm the exact authentication header format supported by JustOneAPI before deployment. 3. **If the upstream API only supports query authentication** - Request header-based authentication support from the provider. - Use narrowly scoped and short-lived tokens where supported. - Configure clients, gateways, reverse proxies, access logs, application monitoring, and error telemetry to redact the `token` query parameter. - Never include the complete request URL in errors, debug output, analytics, or support bundles. 4. **Update documentation and generated artifacts** - Change `SKILL.md` to invoke the helper without `--token`. - Update `generated/operations.json` and `generated/operations.md` so the token is not represented as a normal query input if header authentication is supported. - Document token rotation and immediate revocation procedures for suspected exposure. 5. **Add regression controls** - Add tests asserting that generated request URLs never contain `token`. - Add secret-redaction tests for failure and diagnostic paths. - Use automated secret-handling or URL-policy checks to prevent credentials from being introduced into command argumen ...[truncated 26 chars]