T09 · Insecure Skill Coding Practices
- Location
bin/run.mjs:3411- Finding
API Key Exposed Through Process Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
bin/run.mjs:3411, 3422-3424, 3436-3440, 3505-3508
Related Documentation:SKILL.md:40
Vulnerability Type: Credential exposure through process arguments
Risk Level: MediumVulnerable Code
The documented invocation expands the secret into the command-line argument vector:
bash node {baseDir}/bin/run.mjs --operation "<operation-id>" --api-key "$JUST_SERP_API_KEY" --params-json '{"key":"value"}'The runtime then reads the API key from
process.argvand places it in the authentication header:js const args = parseArgs(process.argv.slice(2)); if (!args.apiKey) { fail("Missing required --api-key argument."); } const requestInit = { headers: { "accept": "application/json", "X-API-Key": args.apiKey, }, method: operation.method, };Argument parsing explicitly accepts the secret through
--api-key:js if (flag === "--api-key") { parsed.apiKey = value; index += 1; continue; }Technical Analysis
Although transmitting the API key to the fixed Just Serp API endpoint in an authentication header is necessary for the declared functionality, passing the key through
--api-keyis not necessary. The shell expands$JUST_SERP_API_KEYbefore Node starts, placing the plaintext credential in the process argument vector.Depending on the host configuration, command-line arguments may be exposed through process inspection interfaces, system monitoring software, audit logs, process supervisors, diagnostic snapshots, or command-history capture. Any local user or monitoring component with sufficient visibility could recover the key while the process is running or from retained telemetry.
The network destination itself is constrained to the hard-coded HTTPS origin
https://api.justserpapi.com; no evidence was found that user parameters can redirect the credential to another host.Attack Path
- A user invokes the Skill using the documented command.
...[truncated 961 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
--api-keycommand-line option and read the credential directly from the declared environment variable:
js const apiKey = process.env.JUST_SERP_API_KEY; if (!apiKey) { fail("Missing required JUST_SERP_API_KEY environment variable."); }- Use the environment-derived value only when constructing the authentication header:
js const requestInit = { headers: { accept: "application/json", "X-API-Key": apiKey, }, method: operation.method, };- Update
SKILL.mdso the invocation does not expand the secret intoargv:
bash node {baseDir}/bin/run.mjs --operation "<operation-id>" --params-json '{"key":"value"}'-
If explicit credential injection is operationally required, accept it through protected standard input or a permission-restricted file descriptor rather than through command-line arguments.
-
Ensure error handling, debug logging, process supervisors, and telemetry systems never record the API key or complete authentication headers.
-
Rotate any key that may previously have been captured in process-monitoring or audit logs, and review associated API usage for unauthorized quota consumption.
- Remove the