T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/starling.sh:137
- Finding
- API Key Exposed Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/starling.sh`, lines 137, 153, 160, and 176 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: High ### Vulnerable Code ```bash body=$(curl -sfS -w '\n%{http_code}' "${CURL_TIMEOUT[@]}" ${CURL_EXTRA[@]+"${CURL_EXTRA[@]}"} "$@" "${BASE_URL}${path}?key=${API_KEY}" 2>&1) || true ``` The same vulnerable URL construction is used by the other request functions: ```bash curl -sfS "${CURL_TIMEOUT[@]}" ${CURL_EXTRA[@]+"${CURL_EXTRA[@]}"} "$@" "${BASE_URL}${path}?key=${API_KEY}" || { ``` ```bash body=$(curl -sfS -w '\n%{http_code}' "${CURL_TIMEOUT[@]}" ${CURL_EXTRA[@]+"${CURL_EXTRA[@]}"} "$@" "${BASE_URL}${path}?key=${API_KEY}&${params}" 2>&1) || true ``` ```bash resp=$(curl -sfS -w '\n%{http_code}' "${CURL_TIMEOUT[@]}" ${CURL_EXTRA[@]+"${CURL_EXTRA[@]}"} -X POST \ -H "Content-Type: application/json" \ -d "$body" \ "${BASE_URL}${path}?key=${API_KEY}" 2>&1) || true ``` ### Technical Analysis The Starling API requires authentication through a `key` query parameter. Although the script initially obtains the key from `STARLING_API_KEY`, it interpolates the secret directly into curl's URL argument. Consequently, the complete URL, including `?key=<API_KEY>`, can appear in the curl process command line while a request is active. Users or monitoring services with permission to inspect that process can recover the credential. This conflicts with the script's warning that only use of the `--key` option creates process-list exposure. The network transmission itself is necessary for the declared functionality, and the query parameter is imposed by the underlying API. However, placing the resulting URL directly in an argv element is not the minimum-exposure way to perform that transmission. ### Attack Path 1. A victim configures a Starling API key through `STARLING_API_KEY`. 2. An attacker with local process-inspection access continuously monitors command lines, ...[truncated 1002 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Avoid placing an authenticated URL directly in a process argument. Where supported, provide sensitive curl configuration through a protected standard-input or file-descriptor channel. 2. Investigate whether the hub accepts an authentication header or another credential mechanism in newer API versions. 3. If query-string authentication is unavoidable, explicitly document that environment-variable use does not prevent curl argv exposure. 4. Run the integration under a dedicated operating-system account and restrict process inspection where the platform permits it. 5. Create narrowly scoped API keys: - Use read-only keys for status monitoring. - Use separate keys for camera access, lock control, and other write operations. - Avoid granting lock or camera permissions to unrelated automation. 6. Rotate the API key after any suspected local process-monitoring exposure. 7. Avoid logging command lines or collecting full process arguments in telemetry and audit systems. ]]>