T09 · Insecure Skill Coding Practices
Error
- Location
- external_ai_integration.py:183
- Finding
- Hugging Face bearer token exposed through process command-line arguments## Vulnerability Details **File Location**: `external_ai_integration.py:183-195` **Vulnerability Type**: Credential exposure through process arguments **Risk Level**: High ### Vulnerable Code ```python cmd = [ "curl", "-s", "-H", f"Authorization: Bearer {token}", "-H", "Content-Type: application/json", "-d", json.dumps(payload), url ] try: output = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True) return json.loads(output) except (subprocess.CalledProcessError, json.JSONDecodeError) as e: raise ValueError(f"Curl call failed: {e}") ``` ### Technical Analysis The curl fallback embeds the complete Hugging Face bearer token in the child process argument list. Although `subprocess.check_output()` is invoked without a shell and is therefore not directly vulnerable to shell injection, command-line arguments may be visible through process-inspection interfaces, local monitoring software, endpoint telemetry, audit systems, crash diagnostics, or debugging tools. The token is passed in plaintext as part of the `-H` argument and remains exposed for the lifetime of the curl process. This exceeds minimum-privilege credential handling because curl does not need the secret to be present in a process argument to authenticate the request. ### Attack Path 1. The `requests` dependency is unavailable, causing `hf_inference()` to invoke `hf_inference_curl()`. 2. The function retrieves a valid Hugging Face token from 1Password, `HF_TOKEN`, or `~/.huggingface/token`. 3. The function launches curl with `Authorization: Bearer <token>` in its process arguments. 4. A local user, monitoring agent, or log collector with permission to inspect the process captures the argument list while curl is running. 5. The captured token is reused to submit Hugging Face API requests under the victim's account. ### Impact Assessment Exploitation can disclose the full Hugging Face bearer ...[truncated 410 chars]
- Remediation
- ## Remediation Suggestions - Prefer the `requests` implementation and remove the curl fallback if it is not essential. - Never place API tokens in command-line arguments. - If curl support is required, pass sensitive configuration through a protected file descriptor or a temporary curl configuration file created with owner-only permissions and deleted immediately after use. - Ensure temporary secret-bearing files are created atomically, have mode `0600`, and are removed in a `finally` block. - Use narrowly scoped and short-lived Hugging Face tokens where supported. - Add automated tests that verify token values never appear in subprocess argument lists, logs, exception messages, or standard output.