T09 · Insecure Skill Coding Practices
Note
- Location
- scripts/opendart.py:210
- Finding
- OpenDART API Key May Be Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/opendart.py:23-26, 210` and `SKILL.md:43-47` **Vulnerability Type**: Credential exposure through command-line arguments **Risk Level**: Low ### Vulnerable Code ```python def get_api_key(cli_key: str | None) -> str: key = cli_key or os.getenv("OPENDART_API_KEY") if not key: raise SystemExit("Missing API key. Use --api-key or set OPENDART_API_KEY") return key ``` ```python p.add_argument("--api-key", help="OpenDART API key (fallback: OPENDART_API_KEY)") ``` The corresponding documentation explicitly advertises this invocation method: ```markdown API key options: - `--api-key <KEY>` - or env var `OPENDART_API_KEY` ``` ### Technical Analysis The script permits an OpenDART API credential to be supplied directly as a process argument. Command-line arguments can be recorded in shell history and may be visible in process metadata to other local users or monitoring tools, depending on operating-system permissions and configuration. The API key is subsequently transmitted as the documented `crtfc_key` query parameter over HTTPS exclusively to OpenDART endpoints. That network transmission is necessary for the Skill’s declared functionality and is not evidence of unrelated data exfiltration. The vulnerability is the local handling and documented command-line entry of the secret, not its authenticated transmission to OpenDART. ### Attack Path 1. A user follows the documented option and runs the script with `--api-key <KEY>`. 2. The complete command may be stored in shell history or temporarily exposed through process-inspection facilities. 3. A local attacker or process with sufficient access reads the command-line argument or history file. 4. The attacker extracts and reuses the OpenDART API key. 5. The attacker makes authenticated OpenDART requests under the victim’s credential and consumes its associated quota. This path requires local visibility into the user’s command history or ...[truncated 443 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `--api-key` argument and accept the credential through `OPENDART_API_KEY`, a permission-restricted credential file, or an interactive hidden prompt. 2. If backward compatibility requires retaining the option, mark it as insecure in both CLI help and `SKILL.md`, and recommend the environment variable or hidden prompt as the default method. 3. Avoid placing secret values in example commands, logs, exceptions, or diagnostic output. 4. Document appropriate permissions for any credential file and ensure it is excluded from source control. 5. Consider supporting standard input or `getpass.getpass()` for interactive use so the key is not echoed or retained in shell history.