T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:49- Finding
API Key Exposed Through Process Command-Line Arguments
- Content
View full analysis
"}' ``` ```javascript if (!args.apiKey) { fail("Missing required --api-key argument."); } ``` ```javascript function parseArgs(argv) { const parsed = { apiKey: null, operation: null, paramsJson: "{}" }; for (let index = 0; index < argv.length; index += 1) { const flag = argv[index]; const value = argv[index + 1]; if (flag === "--operation") { parsed.operation = value; index += 1; continue; } if (flag === "--params-json") { parsed.paramsJson = value; index += 1; continue; } if (flag === "--api-key") { parsed.apiKey = value; index += 1; continue; } fail(`Unknown argument "${flag}".`); } return parsed; } ``` ### Technical Analysis The documented invocation expands `JUST_SERP_API_KEY` into the process argument vector through the `--api-key` option. The executable requires and parses this command-line value rather than reading the credential directly from the environment. Depending on operating-system permissions and deployment configuration, process command lines can be exposed through process inspection facilities, monitoring agents, audit records, debugging tools, job metadata, shell tracing, or command-execution logs. Consequently, a secret that was initially protected as an environment variable may become visible outside the Node.js process. The API request itself uses HTTPS and sends the credential in the `X-API-Key` header. The issue is therefore local credential handling before the network request, not plaintext transmission to the API server. ### Attack Path 1. A user follows the do ...[truncated 1235 chars]- Remediation
View remediation
"}' ``` If the environment is already configured, the assignment should be omitted entirely: ```bash node {baseDir}/bin/run.mjs \ --operation "localSearch" \ --params-json '{"query":""}' ``` 5. If environment variables are unsuitable, accept the secret through a protected standard-input or file-descriptor mechanism rather than through `argv`. 6. Ensure command tracing and debug logging do not record credentials. Rotate the existing API key if it may previously have appeared in process telemetry, shell traces, job logs, or monitoring records. ]]>