T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:167- Finding
API Token Exposed Through Command-Line Arguments
- Content
View full analysis
"}' ``` ```javascript function parseArgs(argv) { const parsed = { operation: null, paramsJson: "{}", token: null }; for (let index = 0; index < argv.length; index += 1) { const flag = argv[index]; const value = argv[index + 1]; if (flag === "--operation") { parsed.operation = value; index += 1; continue; } if (flag === "--params-json") { parsed.paramsJson = value; index += 1; continue; } if (flag === "--token") { parsed.token = value; index += 1; continue; } fail(`Unknown argument "${flag}".`); } return parsed; } ``` ### Technical Analysis The documented invocation expands `JUST_ONE_API_TOKEN` into the process command line, and the executable explicitly accepts the credential through `--token`. Command-line arguments can be captured by process inspection facilities, shell debugging, command telemetry, audit systems, and process-monitoring software. Although operating-system restrictions differ, exposing a secret as an argument creates an avoidable disclosure channel. The Skill already declares `JUST_ONE_API_TOKEN` as its required environment variable, so passing the same credential through the command line exceeds the minimum exposure necessary for the declared API-wrapper functionality. The token is not hardcoded, and the code does not deliberately print it. Nevertheless, placing it in `process.argv` can expose it outside the process before the request is made. ### Attack Path 1. A user launches the Skill using the documented `--token "$JUST_ONE_API_TOKEN"` command. 2. The shell expands the environment variable into the Node.js pro ...[truncated 779 chars]- Remediation
View remediation
"}' ``` 4. Ensure error messages, debug output, and telemetry never include the token. 5. Rotate any token believed to have been captured in process, shell, or execution logs. ]]>