T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:41
- Finding
- API Key Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md:41`; supporting implementation in `bin/run.mjs:129-131` and `bin/run.mjs:156-158` **Vulnerability Type**: API credential exposure through the process argument vector **Risk Level**: Medium ### Vulnerable Code `SKILL.md:41`: ```bash node {baseDir}/bin/run.mjs --operation "<operation-id>" --api-key "$JUST_SERP_API_KEY" --params-json '{"key":"value"}' ``` `bin/run.mjs:129-131`: ```js if (!args.apiKey) { fail("Missing required --api-key argument."); } ``` `bin/run.mjs:156-158`: ```js const requestInit = { headers: { "accept": "application/json", "X-API-Key": args.apiKey, }, method: operation.method, }; ``` The argument parser also explicitly accepts the credential through `--api-key`: ```js if (flag === "--api-key") { parsed.apiKey = value; index += 1; continue; } ``` ### Technical Analysis The documented command expands `JUST_SERP_API_KEY` into the child process argument vector. Command-line arguments may be accessible to other local users or administrative monitoring components through process inspection interfaces, audit records, endpoint telemetry, shell tracing, diagnostic tooling, or process listings. Authentication to the declared Just Serp API is necessary for the Skill's functionality, and transmitting the key in an `X-API-Key` header over the hard-coded HTTPS endpoint is consistent with that purpose. However, passing the credential through a command-line argument is not necessary and exceeds the minimum exposure required. The script can read `process.env.JUST_SERP_API_KEY` directly without placing the secret in its argument vector. No evidence was found that the script deliberately prints the API key or transmits it to an undeclared host. The vulnerability is the avoidable local exposure created before the authenticated HTTPS request is made. ### Attack Path 1. A victim configures `JUST ...[truncated 1184 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `--api-key` command-line option from both the documentation and argument parser. 2. Read the credential directly from the process environment: ```js const apiKey = process.env.JUST_SERP_API_KEY; if (!apiKey) { fail("Missing required JUST_SERP_API_KEY environment variable."); } ``` 3. Construct the authentication header using the environment-derived value: ```js const requestInit = { headers: { accept: "application/json", "X-API-Key": apiKey, }, method: operation.method, }; ``` 4. Update the documented invocation so the secret is not expanded into an argument: ```bash node {baseDir}/bin/run.mjs --operation "<operation-id>" --params-json '{"key":"value"}' ``` 5. As an alternative where environment variables are unsuitable, accept the secret through protected standard input or an operating-system credential store. 6. Keep the key out of error payloads, logs, debug traces, telemetry, and shell tracing. 7. Rotate any API key that may previously have been captured in process telemetry or audit logs.