T09 · Insecure Skill Coding Practices
- Location
scripts/ip_reputation.py:43- Finding
ThreatBook API Key Exposed Through Command-Line Arguments and URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ip_reputation.py, lines 43–47 and 89–98
Vulnerability Type: API credential exposure
Risk Level: MediumVulnerable Code
python # Build request url = "https://api.threatbook.cn/v3/scene/ip_reputation" params = { "apikey": api_key, "resource": ip }python parser.add_argument( "--api_key", required=True, help="ThreatBook API Key" ) args = parser.parse_args() try: result = get_ip_reputation(args.ip, args.api_key)Technical Analysis
The script requires users to provide the ThreatBook API key as a command-line argument. Command-line secrets may be exposed through shell history, process inspection interfaces, endpoint monitoring, audit records, CI/CD output, and job-runner logs.
The script then places the same credential in the query parameters of an HTTP GET request. Although the destination uses HTTPS, TLS only protects the request in transit. The complete URL may still be recorded by client diagnostics, proxies, API gateways, monitoring products, or server access logs.
This implementation is also inconsistent with the rest of the project and with
SKILL.md, which designate theTHREATBOOK_API_KEYenvironment variable as the credential source.Attack Path
- A user invokes the script and supplies the key through
--api_key. - The command, including the plaintext key, is retained in shell history or captured by local process-monitoring or job-logging systems.
- The script inserts the key into the request URL as the
apikeyquery parameter. - Infrastructure capable of recording request URLs may retain another copy of the credential.
- A local user or log reader with access to one of these records extracts the key.
- The attacker reuses the key against ThreatBook APIs until it is revoked or expires.
Impact Assessment
Successful exploitation exposes the privileges associated with the compromised ThreatBook API key. An attacker may make ...[truncated 379 chars]
- A user invokes the script and supplies the key through
- Remediation
View remediation
Remediation Suggestions
- Remove the
--api_keycommand-line option. - Read the credential from
THREATBOOK_API_KEY, consistently with the other scripts and project metadata:
python api_key = os.getenv("THREATBOOK_API_KEY") if not api_key: raise ValueError("THREATBOOK_API_KEY is not configured")- If supported by the ThreatBook endpoint, transmit the key through an authorization header rather than a query parameter:
python headers = { "Authorization": api_key } params = { "resource": ip } response = requests.get(url, headers=headers, params=params, timeout=30)- If the API mandates a query parameter, configure clients, proxies, gateways, monitoring systems, and error handlers to redact
apikeyvalues and avoid logging complete request URLs. - Prevent secrets from appearing in exception messages, debug output, telemetry, and CI/CD logs.
- Revoke and rotate any API keys that may already have been supplied through this command-line interface.
- Add automated tests verifying that credentials are not accepted through command-line arguments and do not appear in generated URLs or logs.
- Update usage documentation so that configuration exclusively references the environment variable.
- Remove the