T09 · Insecure Skill Coding Practices
Warning
- Location
- bin/run.mjs:665
- Finding
- API Access Token Exposed Through URL Query String and Command-Line Arguments## Vulnerability Details **File Location**: `bin/run.mjs:665-675`, `bin/run.mjs:709-722`, and `SKILL.md:43` **Vulnerability Type**: Sensitive credential exposure **Risk Level**: Medium The JustOneAPI access token is accepted as a command-line argument and inserted into the request URL as a query parameter. Sending authentication material is necessary for the Skill's declared API functionality, and the destination is the fixed, documented HTTPS endpoint `https://api.justoneapi.com`. However, placing the token in command-line metadata and the URL exceeds the minimum exposure necessary for authentication. ### Vulnerable Code `SKILL.md:43`: ```bash node {baseDir}/bin/run.mjs --operation "<operation-id>" --token "$JUST_ONE_API_TOKEN" --params-json '{"key":"value"}' ``` `bin/run.mjs:665-675`: ```js function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` `bin/run.mjs:709-722`: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.append(name, String(value)); } ``` The resulting U ...[truncated 2496 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer an authentication header supported by the service, such as: ```js const token = process.env.JUST_ONE_API_TOKEN; requestInit.headers.authorization = `Bearer ${token}`; ``` Confirm the exact header scheme with the JustOneAPI specification before deployment. 2. Read `JUST_ONE_API_TOKEN` directly from the environment instead of requiring `--token`, preventing routine exposure through process arguments. 3. Remove `token` from every operation's query-parameter definition when header authentication is available, and explicitly reject `token` supplied through `--params-json`. 4. If the upstream API only supports query-string authentication, document that limitation, use a narrowly scoped and short-lived token, disable query-string logging where possible, and configure reverse proxies, API gateways, monitoring systems, and error reporters to redact the `token` parameter. 5. Ensure request errors and diagnostics never print the complete request URL or serialized parameter object containing credentials. 6. Rotate any token that may already have appeared in process telemetry or URL logs, and review retained logs for unauthorized disclosure and use.