T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:28
- Finding
- Apify API Token Exposed in URL Query Parameters<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 28–54 **Vulnerability Type**: Sensitive credential exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```bash RESULT=$(curl -s -X POST "https://api.apify.com/v2/acts/WAJfBnZBYR9mJrk5d/run-sync-get-dataset-items?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["SEARCH_TERM"], "maxResults": 50, "sortBy": "relevance"}') ``` ```bash RUN_ID=$(curl -s -X POST "https://api.apify.com/v2/acts/WAJfBnZBYR9mJrk5d/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms": ["TERM"], "maxResults": 50}' | jq -r '.data.id') ``` ```bash STATUS=$(curl -s "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | jq -r '.data.status') # Poll every 5s until SUCCEEDED or FAILED curl -s "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN" | jq '.' ``` ```bash curl -s "https://api.apify.com/v2/actor-runs/$RUN_ID/log?token=$APIFY_TOKEN" ``` ### Technical Analysis The Skill places the sensitive `APIFY_TOKEN` directly into the query string of every Apify API request. Authentication is necessary for the declared scraping functionality, but including the credential in URLs is not the minimum-risk authentication method. Although HTTPS encrypts the URL while it is in transit, query-string credentials may still be exposed through: - Local process listings while `curl` is running. - Shell tracing or command-execution diagnostics. - HTTP proxy, gateway, access, or monitoring logs. - Debugging and error-reporting systems that record complete request URLs. - Copied terminal output or diagnostic records containing the executed command. The same unsafe pattern is used for starting synchronous and asynchronous Actor runs, polling status, retrieving dataset items, and retrieving logs. This unnecessarily broadens the opportunities for credential disclosure. The network communication with `api. ...[truncated 1711 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `token=$APIFY_TOKEN` from every request URL. 2. Pass the credential through Apify's supported authorization header: ```bash curl -s -X POST \ "https://api.apify.com/v2/acts/WAJfBnZBYR9mJrk5d/run-sync-get-dataset-items" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"searchTerms":["SEARCH_TERM"],"maxResults":50,"sortBy":"relevance"}' ``` 3. Apply the same header-based authentication pattern to Actor creation, status polling, dataset retrieval, and log retrieval. 4. Avoid enabling shell tracing such as `set -x` while handling credentials. If tracing is required, disable it before authenticated requests and restore it afterward. 5. Do not print complete authorization headers, request commands, or secret-bearing environment variables in logs or error messages. 6. Use a minimally privileged Apify token where supported and separate tokens by environment or workload. 7. Restrict access to execution logs, proxy logs, and monitoring data. 8. Rotate any token that may previously have appeared in URLs or retained logs. 9. Inform users that their Bluesky search terms and requested result limits are sent to the third-party Apify service as part of the Skill's declared operation. ]]>