T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/elevenlabs.py:134
- Finding
- ElevenLabs API Key Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/elevenlabs.py:134-139` **Related Documentation**: `SKILL.md:17-20`, `SKILL.md:53` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```python parser.add_argument("--api-key", help="ElevenLabs API key (overrides env var)") args = parser.parse_args() try: api_key = args.api_key or get_api_key() ``` The documentation explicitly promotes this credential-handling method: ```markdown Or pass it directly with `--api-key`. ``` ### Technical Analysis The Skill permits users to supply a plaintext ElevenLabs API key as a command-line argument. Command-line arguments can be exposed through shell history, process inspection utilities, endpoint-monitoring systems, diagnostic reports, audit logs, and process metadata collected by orchestration platforms. This exposure is unnecessary because the implementation already supports retrieving the key from the `ELEVENLABS_API_KEY` environment variable. Although the key must legitimately be sent to the fixed ElevenLabs HTTPS API endpoint in the `xi-api-key` header for the declared functionality, placing it in the process argument list expands its exposure beyond the minimum privileges and data flows required. No evidence was found that the Skill intentionally transmits the key to an unrelated service. Requests are directed to the fixed endpoint `https://api.elevenlabs.io/v1`; therefore, the vulnerability concerns local credential disclosure rather than malicious network exfiltration. ### Attack Path 1. A user follows the documented guidance and invokes the script with `--api-key sk_...`. 2. The plaintext API key becomes part of the process argument list and may also be saved in shell history or process-monitoring records. 3. A local user, monitoring agent, support-data collector, or other principal with access to that metadata retrieves the key. ...[truncated 937 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `--api-key` command-line option and the `args.api_key` fallback so credentials cannot be supplied through process arguments. 2. Continue supporting `ELEVENLABS_API_KEY` for non-interactive execution, while ensuring deployment systems inject it through an approved secret manager rather than committed configuration files. 3. If interactive credential entry is required, use `getpass.getpass()` so the value is neither echoed nor included in the command line. 4. For file-based secret support, require a permission-restricted file, validate its ownership and permissions where practical, and read only the credential value. 5. Update `SKILL.md` to remove all recommendations and option-table entries that promote `--api-key`. 6. Advise users who previously supplied keys through command-line arguments to clear relevant shell history and logs and rotate potentially exposed keys. 7. Avoid including API keys in exception messages, debug output, telemetry, or request logging.