T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:27
- Finding
- API Token Exposed in URL Query Strings## Vulnerability Details **File Location**: `SKILL.md`, lines 27-40 **Vulnerability Type**: Credential exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```bash RESULT=$(curl -s -X POST "https://api.apify.com/v2/acts/BULaGFURBV7WG3K81/run-sync-get-dataset-items?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"urls": ["https://example.substack.com"], "maxArticles": 20}') echo "$RESULT" | jq '.' ``` ```bash RUN_ID=$(curl -s -X POST "https://api.apify.com/v2/acts/BULaGFURBV7WG3K81/runs?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"urls": ["https://example.substack.com"], "maxArticles": 100}' | jq -r '.data.id') curl -s "https://api.apify.com/v2/actor-runs/$RUN_ID?token=$APIFY_TOKEN" | jq -r '.data.status' curl -s "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN" | jq '.' ``` ### Technical Analysis The Skill expands the `APIFY_TOKEN` environment variable directly into the query string of every authenticated API URL. Authentication with Apify is necessary for the declared scraping workflow, and the credential is sent only to the declared `api.apify.com` service. However, placing a secret in a URL creates a broader exposure surface than necessary. Complete URLs may be captured by shell tracing, process or command telemetry, HTTP proxies, access logs, monitoring platforms, debugging output, and error reports. HTTPS protects the request while it is in transit but does not prevent endpoints or intermediary infrastructure from recording the URL. A recorded URL would contain the reusable token in plaintext. The Skill also sends user-provided Substack URLs and scraping parameters to a third-party hosted Actor. This external processing is consistent with the declared functionality, but users should not submit private URLs or confidential parameters without understanding Apify's data-handling boundaries. ### Attack Path ...[truncated 1239 chars]
- Remediation
- ## Remediation Suggestions Remove `APIFY_TOKEN` from all URL query strings and provide it through an authorization header instead: ```bash RESULT=$(curl -s -X POST \ "https://api.apify.com/v2/acts/BULaGFURBV7WG3K81/run-sync-get-dataset-items" \ -H "Authorization: Bearer $APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"urls":["https://example.substack.com"],"maxArticles":20}') ``` Apply the same header-based authentication pattern to Actor launch, run-status, and dataset requests. In addition: - Use a narrowly scoped Apify token with only the permissions required for this Actor and its datasets. - Avoid enabling shell tracing, verbose command logging, or diagnostic collection around authenticated commands. - Redact authorization headers and credentials from application and infrastructure logs. - Rotate any token that may previously have been recorded in logs or telemetry. - Document that requested URLs and scrape parameters are processed by a third-party hosted Actor. - Warn users not to submit confidential URLs or parameters unless the third-party processing and retention policy is acceptable.