T09 · Insecure Skill Coding Practices
Error
- Location
core/AnalyticsEngine.js:95- Finding
Postiz API Key Exposed Through Shell Command Strings and Error Logs
- Content
View full analysis
new Date(post.publishDate) >= cutoffDate ); // Get analytics for each post const postsWithAnalytics = []; for (const post of recentPosts) { try { const analyticsCmd = `POSTIZ_API_KEY=${this._shellEscape(this.postiz.apiKey)} postiz analytics:post ${this._shellEscape(post.id)}`; const analyticsOutput = execSync(analyticsCmd, { encoding: 'utf8' }); ``` ```javascript // core/AnalyticsEngine.js:131 console.error('Failed to fetch post metrics:', error.message); ``` ```javascript // core/AnalyticsEngine.js:143-147 const cmd = `POSTIZ_API_KEY=${this._shellEscape(this.postiz.apiKey)} postiz analytics:platform ${this._shellEscape(integrationId)}`; const output = execSync(cmd, { encoding: 'utf8' }); return JSON.parse(output); } catch (error) { console.error('Failed to fetch platform metrics:', error.message); ``` ```javascript // core/Publisher.js:143-146 const cmd = `POSTIZ_API_KEY=${this._shellEscape(this.postiz.apiKey)} postiz upload ${this._shellEscape(mediaPath)}`; const output = execSync(cmd, { encoding: 'utf8' }); const url = output.trim().split('\n').pop(); mediaUrls.push(url); ``` ```javascript // core/Publisher.js:171-195 _buildPostizCommand(params) { const { integrationId, mediaUrls, caption, title, sc ...[truncated 3066 chars]- Remediation
View remediation