T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:222- Finding
API Token Exposed Through Process Arguments and URL Query Parameters
- Content
View full analysis
","commentId":""}' ``` ## Environment - Required: `JUST_ONE_API_TOKEN` - Pass the token with `--token "$JUST_ONE_API_TOKEN"`; do not paste token values into chat messages, screenshots, or logs. ``` The executable injects that command-line token into the request parameters: ```js const params = parseParams(args.paramsJson); applyDefaults(operation, params); injectToken(operation, params, args.token); validateRequired(operation, params); ``` The token is then treated as a query parameter and appended to the outbound URL: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` ### Technical Analysis The Skill legitimately requires a JustOneAPI credential to perform its declared operation, and the destination is fixed to the documented HTTPS service at `api.justoneapi.com`. The outbound transfer is therefore not covert credential exfiltration and does not exceed the functional endpoint scope. However, the credential is handled through two exposure-prone channels: 1. The shell expands `"$JUST_ONE_API_TOKEN"` into the Node process argument list. Depending on operating-system permissions and telemetry configuration, process-monitoring tools, diagnostic collectors, shell tracing, or other local users may be able to rec ...[truncated 1966 chars]- Remediation
View remediation
","commentId":""}' ``` 6. Add automated tests confirming that errors, standard output, and standard error never contain the token. ]]>