T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/aminer_client.py:773- Finding
AMiner API token exposed through command-line arguments
- Content
View full analysis
--action scholar_profile --name "Andrew Ng" ``` The supplied value is subsequently used as an authorization credential: ```python headers = { "Authorization": token, "Content-Type": "application/json;charset=utf-8", } ``` ### Technical Analysis Command-line arguments are generally not a secure channel for secrets. Depending on the operating system and deployment environment, the complete invocation may be exposed through: - Shell history files. - Process-listing facilities while the client is running. - Process telemetry and audit logs. - CI/CD job output or orchestration metadata. - Wrapper scripts and operational troubleshooting records. The network use of the token itself is consistent with the Skill's declared functionality: it is placed in the `Authorization` header and sent over HTTPS to the fixed AMiner endpoint. The security flaw is the method used to introduce the token into the process. The audit found no evidence that the token is intentionally transmitted to an unrelated host. Nevertheless, local disclosure is sufficient to compromise the credential. ### Attack Path 1. A user follows the documented examples and invokes the client with a real token in `--token`. 2. The operating environment records the command in shell history, process telemetry, job ...[truncated 922 chars]- Remediation
View remediation