T09 · Insecure Skill Coding Practices
- Location
apis/crm.md:238- Finding
Pipedrive API token exposed through URL query parameters
- Content
View full analysis
Vulnerability Details
File Location:
apis/crm.md, lines 238-284
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: MediumThe Pipedrive reference repeatedly places the user's API token in request URLs:
bash # API Key auth (query param) curl "https://api.pipedrive.com/v1/deals?api_token=$PIPEDRIVE_API_KEY" # List Deals curl "https://api.pipedrive.com/v1/deals?api_token=$PIPEDRIVE_API_KEY&status=open&limit=50" # Create Deal curl -X POST "https://api.pipedrive.com/v1/deals?api_token=$PIPEDRIVE_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "title": "New Deal", "value": 5000, "currency": "USD", "person_id": 123, "org_id": 456 }' # Get Person (Contact) curl "https://api.pipedrive.com/v1/persons/123?api_token=$PIPEDRIVE_API_KEY" # Create Activity curl -X POST "https://api.pipedrive.com/v1/activities?api_token=$PIPEDRIVE_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "subject": "Call with client", "type": "call", "due_date": "2024-03-15", "deal_id": 789 }' # Search Items curl "https://api.pipedrive.com/v1/itemSearch?term=acme&item_types=deal,person&api_token=$PIPEDRIVE_API_KEY"Technical Analysis
Environment-variable expansion inserts the real Pipedrive credential directly into the URL passed to
curl. Although HTTPS protects the URL while it is transported over the network, URLs are commonly captured by local process inspection, shell debugging output, HTTP client diagnostics, reverse proxies, gateways, observability platforms, and server access logs.This advice also conflicts with the project's own rule in
SKILL.md:103, which states that API keys should be placed in headers instead of URL query parameters. The Pipedrive section acknowledges that query-parameter authentication is deprecated for OAuth applications but nevertheless presents it as the ...[truncated 1567 chars]- Remediation
View remediation
Remediation Suggestions
- Replace query-parameter authentication examples with OAuth bearer authentication:
bash curl "https://api.pipedrive.com/v1/deals?status=open&limit=50" \ -H "Authorization: Bearer $PIPEDRIVE_ACCESS_TOKEN" - Present OAuth as the default and recommended authentication mechanism throughout the Pipedrive section.
- If legacy query authentication must remain documented, mark it clearly as deprecated and unsafe for environments where URLs are logged.
- Recommend short-lived, narrowly scoped credentials and separate test and production accounts.
- Warn users not to enable shell tracing, verbose HTTP diagnostics, or URL logging while using credentials.
- Configure proxies, gateways, monitoring systems, and access logs to redact
api_tokenand other credential-bearing parameters. - Rotate any credential suspected of appearing in logs and remove historical unredacted records where feasible.
- Add an automated documentation check that rejects examples containing secret-like variables in URL query strings.
- Replace query-parameter authentication examples with OAuth bearer authentication: