T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:239- Finding
Authentication Token Exposed Through Command-Line Arguments and URL Query Parameters
- Content
View full analysis
parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` All query parameters, including the token, are appended to the request URL in `bin/run.mjs:239-247` and `bin/run.mjs:255-270`: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof val ...[truncated 2585 chars]- Remediation
View remediation
"}' ``` 5. If the upstream API only supports query-string authentication, document that residual limitation and implement compensating controls: - Redact the `token` query parameter from API gateway, proxy, tracing, telemetry, and server access logs. - Never include the complete request URL in errors or diagnostics. - Use narrowly scoped, short-lived tokens where available. - Rotate any token suspected of appearing in process or URL logs. - Restrict access to process metadata and operational logs. ]]>