T09 · Insecure Skill Coding Practices
- Location
SKILL.md:54- Finding
API Credential Exposure Through URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 54-74; related credential-storage guidance at line 168
Vulnerability Type: API credential exposure and insecure secret handling
Risk Level: MediumVulnerable Code
bash curl -o template_input.xlsx \ "https://1440636612-55rmw631p6.ap-beijing.tencentscf.com/template?key=$KEY"bash curl -X POST \ "https://1440636612-55rmw631p6.ap-beijing.tencentscf.com/generate?key=$KEY" \ -F "file=@template_input.xlsx" \ -o result.zipThe documentation also recommends saving the key to a local file but does not specify access restrictions, encryption, or use of an operating-system secret store.
Technical Analysis
The API credential is transmitted as the
keyURL query parameter. Although HTTPS protects the URL in transit, query strings are commonly retained by web servers, reverse proxies, cloud-function telemetry, monitoring systems, command histories, diagnostic output, and endpoint security products. Anyone with access to these records could recover the credential.Saving the credential to an unspecified local file introduces an additional disclosure risk if the file inherits permissive access rights, is synchronized to cloud storage, included in backups, or committed to source control.
This behavior exceeds secure minimum-privilege practices because the same authentication goal can be achieved without placing reusable credentials in URLs. The issue is limited to credential handling; the audited file does not demonstrate privilege escalation or remote code execution.
Attack Path
- A user follows the documented command and invokes the template or generation endpoint with the API key in the query string.
- The complete URL is retained in shell history, proxy logs, server access logs, cloud telemetry, or monitoring records.
- Alternatively, the user stores the key in a locally readable file as suggested by the documentat ...[truncated 1066 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove API keys from all URL query parameters.
- Transmit credentials through an HTTP authorization header, for example:
bash curl -H "Authorization: Bearer $KEY" \ "https://1440636612-55rmw631p6.ap-beijing.tencentscf.com/template" - Update the server to reject credentials supplied through query strings.
- Configure the cloud function, reverse proxy, and monitoring systems to redact authorization headers and other authentication data.
- Do not print the key to the terminal unless explicitly requested, because terminal output may be logged.
- Store the key in an operating-system credential manager. If file storage is unavoidable, use a dedicated file restricted to the current account, such as mode
0600on compatible systems. - Warn users not to commit credential files to source control, synchronize them to shared storage, or include them in unprotected backups.
- Use short-lived, narrowly scoped tokens and provide revocation and rotation mechanisms.
- Document the exact permissions associated with each key and enforce rate limits and server-side authorization for every endpoint.