T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_slide_images.py:24- Finding
Gemini API Key Exposed Through Command-Line Arguments and Request URLs
- Content
View full analysis
tuple[bytes, str] | None: """Generate image using Gemini 3 Pro Image (generateContent with IMAGE modality).""" url = f"https://generativelanguage.googleapis.com/v1beta/models/{model}:generateContent?key={api_key}" payload = json.dumps({ "contents": [{"parts": [{"text": f"Generate this image: {prompt}"}]}], "generationConfig": {"responseModalities": ["IMAGE", "TEXT"]}, }).encode() req = urllib.request.Request(url, data=payload, headers={"Content-Type": "application/json"}) ``` ```python def generate_with_imagen(prompt: str, api_key: str, model: str = FALLBACK_MODEL) -> tuple[bytes, str] | None: """Generate image using Imagen 4.0 (predict endpoint).""" url = f"https://generativelanguage.googleapis.com/v1beta/models/{model}:predict?key={api_key}" payload = json.dumps({ "instances": [{"prompt": prompt}], "parameters": {"sampleCount": 1, "aspectRatio": "16:9"}, }).encode() req = urllib.request.Request(url, data=payload, headers={"Content-Type": "application/json"}) ``` ```python parser.add_argument("--api-key", default=os.environ.get("GEMINI_API_KEY", ""), help="Gemini API key") ``` The unsafe command-line method is also documented in `SKILL.md:73-76`: ```bash python3 scripts/generate_slide_images.py \ --prompts-file prompts.json \ --output-dir ./images \ --api-key "$GEMINI_API_KEY" ``` ### Technical Analysis The Gemini API key is interpolated directly into the query string of every request. HTTPS protects the request contents while in transit, but it does not prevent the complete URL from being retained by URL-aware ...[truncated 2107 chars]- Remediation
View remediation