T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:222- Finding
API Token Exposure Through Command-Line Arguments and URL Query Parameters
- Content
View full analysis
"}' ``` `bin/run.mjs:21-29`: ```js { "defaultValue": null, "description": "API access token.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" } ``` `bin/run.mjs:80-91`: ```js const params = parseParams(args.paramsJson); applyDefaults(operation, params); injectToken(operation, params, args.token); validateRequired(operation, params); const baseUrl = manifest.baseUrl; const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); ``` `bin/run.mjs:222-230`: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` ### Technical Analysis The Skill accepts the JustOneAPI access token through the `--token` command-line option and injects it into the request parameters. Because the manifest defines `token` as a query parameter, `applyQueryParams` appends the credential to the request URL before `fetch` sends the request to `https://api.justoneapi.com`. Passing a secret through a command-line argument can expose it through process listings, process inspection interfaces, shell auditing, command-execution telemetry, or wrapper logs. Although shell expansion of an environment variable prevents the literal token from being stored in the documented command itself, the expanded value is ...[truncated 2065 chars]- Remediation
View remediation