T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/research-keyword.sh:19
- Finding
- DataForSEO Credentials Exposed Through Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/research-keyword.sh`, lines 19-39 **Vulnerability Type**: Credentials exposed through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```bash DFORSEO_LOGIN="${DATAFORSEO_LOGIN}" DFORSEO_PASS="${DATAFORSEO_PASSWORD}" if [ -z "$DFORSEO_LOGIN" ] || [ -z "$DFORSEO_PASS" ]; then echo "Error: DATAFORSEO_LOGIN and DATAFORSEO_PASSWORD env vars are required." echo "Get your credentials at https://dataforseo.com" exit 1 fi echo "=== Keyword Research: $KEYWORD (lang=$LANG, loc=$LOCATION) ===" echo "" # 1. Search volume echo "--- Search Volume ---" curl -s -X POST "https://api.dataforseo.com/v3/keywords_data/google_ads/search_volume/live" \ -u "$DFORSEO_LOGIN:$DFORSEO_PASS" \ -H "Content-Type: application/json" \ -d "[{\"keywords\":[\"$KEYWORD\"],\"language_code\":\"$LANG\",\"location_code\":$LOCATION}]" | ``` The same credential-passing pattern is repeated in the second authenticated request at lines 52-56. ### Technical Analysis The script passes the DataForSEO login and password to `curl` through the `-u` command-line option. This places the expanded credential pair in the process argument vector while `curl` is running. Depending on operating-system process visibility, container configuration, monitoring software, logging, and user permissions, another local process may be able to inspect the arguments and recover the credentials. Although transmission to `https://api.dataforseo.com` is declared and necessary for keyword research, exposing credentials through process metadata is not necessary. There is no evidence that the credentials are deliberately sent to an unrelated service. The vulnerability concerns local secret handling rather than covert network exfiltration. ### Attack Path 1. A user configures `DATAFORSEO_LOGIN` and `DATAFORSEO_PASSWORD`. 2. The Skill invokes `research-keyword.sh`. 3. The script expands both values into the `curl -u` argument. 4. A local ...[truncated 700 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Avoid passing secrets directly through command-line arguments. - Supply credentials using a protected curl configuration through standard input or another secret mechanism that does not expose them in the process argument vector. - Ensure any temporary credential material is created with restrictive permissions and deleted reliably; preferably avoid filesystem-backed temporary secret files entirely. - Use narrowly scoped, revocable API credentials when DataForSEO supports them. - Restrict process visibility between users and workloads on shared systems. - Ensure process monitoring, debugging, and CI logs do not capture authentication values. - Rotate the credentials if there is evidence that process arguments have previously been collected or exposed. ]]>