T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/elfa_call.sh:44- Finding
Sensitive authentication material is exposed through command-line arguments
- Content
View full analysis
Pre-signed x402 payment header (base64). Requires --x402. --hmac-secret HMAC secret for Auto mutation endpoints (POST/DELETE on /v2/auto/). Can also be set via ELFA_HMAC_SECRET env var. --agent-secret Agent identity secret added as x-elfa-agent-secret header ``` The argument parser stores these command-line values: ```bash --payment) [[ $# -lt 2 ]] && die "--payment requires a value"; PAYMENT="$2"; shift 2 ;; --hmac-secret) [[ $# -lt 2 ]] && die "--hmac-secret requires a value"; HMAC_SECRET="$2"; shift 2 ;; --agent-secret) [[ $# -lt 2 ]] && die "--agent-secret requires a value"; AGENT_SECRET="$2"; shift 2 ;; ``` Authentication material is subsequently included in the `curl` argument vector: ```bash if [[ "$X402" == true ]]; then CURL_ARGS+=(-H "X-PAYMENT: ${PAYMENT}") # Add agent-secret header only for x402 Auto requests when provided if [[ -n "$AGENT_SECRET" ]] && [[ "$IS_AUTO_ENDPOINT" == true ]]; then CURL_ARGS+=(-H "x-elfa-agent-secret: ${AGENT_SECRET}") fi else CURL_ARGS+=(-H "x-elfa-api-key: ${ELFA_API_KEY}") fi ``` The HMAC secret is also passed directly as an argument to the OpenSSL subprocess: ```bash SIGNATURE=$(printf '%s' "$SIGN_PAYLOAD" | openssl dgst -sha256 -hmac "$HMAC_SECRET" | sed 's/^.* //') ``` The Skill documentation recommends invoking the helper with the secret-valued option: ```bash ./scripts/elfa_call.sh /v2/trade/orders -d '{"exchange":"hyperliquid","symbol":"BTC","side":"buy","orderType":"market","amount":"25"}' --hmac-secret "$ELFA_HMAC_SECRET" ``` ### Technical Analysis Operating systems ...[truncated 3511 chars]- Remediation
View remediation