T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:183- Finding
API Token Exposed Through Process Arguments and URL Query Parameters
- Content
View full analysis
"}' ``` The operation metadata classifies the token as a query parameter: ```js { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" } ``` The helper injects the command-line token into the parameter collection: ```js function injectToken(operation, params, cliToken) { const tokenParam = operation.parameters.find((parameter) => parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` Every parameter marked as a query parameter—including the token—is appended to the request URL before transmission: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.append(name, String(value)); } ``` The resulting ...[truncated 2786 chars]- Remediation
View remediation
"}' ``` 6. If the upstream API only supports query-string authentication, explicitly document the residual exposure risk, configure all infrastructure to redact the `token` parameter, disable query-string logging where possible, use narrowly scoped short-lived tokens, and rotate any token suspected of appearing in logs. 7. Add automated tests that assert credentials never appear in generated URLs, standard output, standard error, or diagnostic payloads when header-based authentication is available. ]]>