T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:334- Finding
API Key Exposed Through Command-Line Arguments
- Content
View full analysis
"}' ``` The implementation requires and parses the key from that argument: ```js if (!args.apiKey) { fail("Missing required --api-key argument."); } const params = parseParams(args.paramsJson); applyDefaults(operation, params); validateRequired(operation, params); const baseUrl = manifest.baseUrl; const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); const requestInit = { headers: { "accept": "application/json", "X-API-Key": args.apiKey, }, method: operation.method, }; ``` ```js function parseArgs(argv) { const parsed = { apiKey: null, operation: null, paramsJson: "{}" }; for (let index = 0; index < argv.length; index += 1) { const flag = argv[index]; const value = argv[index + 1]; if (flag === "--operation") { parsed.operation = value; index += 1; continue; } if (flag === "--params-json") { parsed.paramsJson = value; index += 1; continue; } if (flag === "--api-key") { parsed.apiKey = value; index += 1; continue; } fail(`Unknown argument "${flag}".`); } return parsed; } ``` ### Technical Analysis Shell expansion of `"$JUST_SERP_API_KEY"` places the secret in the Node process argument vector. Depending on operating-system process visibility, container configuration, monitoring software, shell auditing, and diagnostic tooling, command-line arguments may be exposed through process inspection facilities or c ...[truncated 1877 chars]- Remediation
View remediation
"}' ``` If the environment is already exported, omit the redundant inline assignment entirely. 5. For environments where environment-variable exposure is also a concern, support reading the key from standard input or a credential file with restrictive permissions. Do not print the value in errors, debug output, or telemetry. 6. Rotate any API key that may previously have been exposed through process listings or command-line logging. Apply server-side scope, quota, and expiration restrictions where supported. ]]>