T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:35- Finding
API Token Exposed Through Process Command-Line Arguments
- Content
View full analysis
"}' ``` The executable explicitly accepts the credential through a command-line flag: ```js if (flag === "--token") { parsed.token = value; index += 1; continue; } ``` ### Technical Analysis The documented invocation expands `JUST_ONE_API_TOKEN` into the process argument vector. On operating systems where process arguments are accessible through process inspection tools, `/proc` interfaces, monitoring agents, shell auditing, crash reports, or command telemetry, the plaintext token may be exposed to local users or log operators. This transmission mechanism is not required merely because the Skill needs a token. The implementation could read `JUST_ONE_API_TOKEN` directly from the environment without copying it into the argument vector. Environment variables still require protection, but this avoids the additional process-list exposure introduced by `--token`. ### Attack Path 1. A user invokes the Skill using the documented command. 2. The shell expands `$JUST_ONE_API_TOKEN` into the plaintext `--token` argument. 3. While the Node.js process is running, an attacker with sufficient local process-inspection access, or a monitoring system that records command lines, captures the argument vector. 4. The attacker extracts the token following `--token`. 5. The token is reused to make unauthorized requests to JustOneAPI, subject to the token's assigned permissions and service-side limits. ### Impact Assessment Successful exploitation discloses the JustOneAPI access token. An attacker could make API requests authorized by that token, consume its quota, incur associated usage costs, and access any other JustOneA ...[truncated 280 chars]- Remediation
View remediation