T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:152- Finding
API Token Exposure Through Command-Line Arguments
- Content
View full analysis
"}' ``` ```js function parseArgs(argv) { const parsed = { operation: null, paramsJson: "{}", token: null }; for (let index = 0; index < argv.length; index += 1) { const flag = argv[index]; const value = argv[index + 1]; if (flag === "--operation") { parsed.operation = value; index += 1; continue; } if (flag === "--params-json") { parsed.paramsJson = value; index += 1; continue; } if (flag === "--token") { parsed.token = value; index += 1; continue; } fail(`Unknown argument "${flag}".`); } return parsed; } ``` ### Technical Analysis The documented invocation expands `JUST_ONE_API_TOKEN` into the process argument vector, and the runner explicitly parses it from `process.argv`. Secrets passed this way may be observable through process-inspection interfaces, privileged monitoring tools, shell tracing, command telemetry, crash diagnostics, or orchestration metadata. Although access to process arguments depends on operating-system controls and local privileges, command-line arguments are not an appropriate secret-transport mechanism when the token is already available as an environment variable. This exposure is not required for the Skill’s declared API-wrapper functionality. ### Attack Path 1. A user follows the documented command and starts the runner with a valid token supplied through `--token`. 2. While the process is running, a local actor or monitoring component with permission to inspect process metadata records the argument vector. 3. The actor extracts the token following the `--token` argument. 4. The token is replayed a ...[truncated 558 chars]- Remediation
View remediation