T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/route.sh:26- Finding
Amap API key exposed through curl process arguments
- Content
View full analysis
/dev/null) TO_LOC=$(curl -s "https://restapi.amap.com/v3/geocode/geo?address=${TO}&key=${API_KEY}" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['geocodes'][0]['location'] if d.get('geocodes') else '')" 2>/dev/null) if [ -z "$FROM_LOC" ] || [ -z "$TO_LOC" ]; then echo "Error: Geocoding failed; verify that the supplied addresses are valid" exit 1 fi curl -s "https://restapi.amap.com/v3/direction/${MODE}?origin=${FROM_LOC}&destination=${TO_LOC}&key=${API_KEY}" | python3 -c " ``` The usage example in `SKILL.md` demonstrates the same pattern by interpolating the API key into curl request URLs. ### Technical Analysis The script expands `API_KEY` into each URL before starting curl. Consequently, the complete URL, including the `key` query parameter, becomes part of curl's process argument vector. On systems where process metadata is visible to other users, a local account or monitoring process can inspect the command through facilities such as `/proc`, `ps`, process accounting, audit logging, or observability agents. Although HTTPS protects the query string in transit, it does not prevent local disclosure through the process list. Embedding credentials in URLs also increases the chance that they will be captured by debugging output, proxy logs, shell tracing, or telemetry that records request URLs. The documentation propagates this unsafe usage pattern to users. ### Attack Path 1. A victim configures a valid Amap API key and invokes `scripts/route.sh`. 2. The shell expands ...[truncated 944 chars]- Remediation
View remediation