T09 · Insecure Skill Coding Practices
- Location
SKILL.md:40- Finding
API Key Exposed Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:40,SKILL.md:46,bin/run.mjs:67-69, andbin/run.mjs:84-88
Vulnerability Type: Credential exposure through process arguments
Risk Level: MediumThe documented invocation explicitly passes the Just Serp API key through the
--api-keycommand-line argument:bash node {baseDir}/bin/run.mjs --operation "renderedHtml" --api-key "$JUST_SERP_API_KEY" --params-json '{"url":"<url>"}'The accompanying instruction reinforces this usage:
markdown - Pass the API key with `--api-key "$JUST_SERP_API_KEY"`; do not paste key values into chat messages, screenshots, or logs.The executable requires the command-line value and places it in the outbound authentication header:
js if (!args.apiKey) { fail("Missing required --api-key argument."); }js const requestInit = { headers: { "accept": "application/json", "X-API-Key": args.apiKey, }, method: operation.method, };Technical Analysis
Although the key is not deliberately printed by the script, passing it as a command-line argument places the expanded secret in the process argument vector. Depending on the operating-system configuration and execution environment, command lines may be accessible through process inspection utilities, process metadata interfaces, container management systems, audit services, crash diagnostics, shell tracing, or monitoring agents.
Environment-variable expansion does not prevent this exposure: the shell substitutes
$JUST_SERP_API_KEYbefore starting Node.js, so the actual secret becomes part of the child process arguments. The code then parses and retains that value before transmitting it to the legitimate API endpoint as theX-API-Keyheader.No hardcoded credential, deliberate credential exfiltration, persistence mechanism, or unauthorized destination was identified. The vulnerability is the insecure credenti ...[truncated 1355 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove
--api-keyfrom the documented command and read the credential directly from the environment:js const apiKey = process.env.JUST_SERP_API_KEY; if (!apiKey) { fail("Missing required JUST_SERP_API_KEY environment variable."); } -
Use the environment-derived value in the request header:
js const requestInit = { headers: { "accept": "application/json", "X-API-Key": apiKey, }, method: operation.method, }; -
Update the documented invocation so the key is not supplied as an argument:
bash JUST_SERP_API_KEY="$JUST_SERP_API_KEY" node {baseDir}/bin/run.mjs \ --operation "renderedHtml" \ --params-json '{"url":"<url>"}'If the variable is already exported, omit the assignment entirely.
-
Remove support for the
--api-keyflag to prevent users from accidentally reverting to the insecure mechanism. If backward compatibility is temporarily required, emit a deprecation warning without including the supplied value. -
Ensure application logs, shell tracing, process-monitoring agents, CI job output, and diagnostic tooling do not capture secrets. Prefer an operating-system or orchestration-platform secret manager for production deployments.
-
Rotate any API keys previously used through the documented command where untrusted users or telemetry systems may have had access to process metadata.
-