T09 · Insecure Skill Coding Practices
Warning
- Location
furryart.js:3- Finding
API Token Exposed Through Command-Line Arguments
- Content
View full analysis
"your prompt" --token "$NETA_TOKEN" ``` ```bash node furryart.js "your description here" --token YOUR_TOKEN ``` ### Technical Analysis The script obtains the API token from `process.argv`. Command-line arguments are not an appropriate secret-transport mechanism because they can be exposed through operating-system process inspection, command auditing, terminal or automation logs, and shell history when a literal token is used. Although `package.json` declares a required environment variable named `NETA_TOKEN`, the implementation does not read `process.env.NETA_TOKEN`. Even the documented environment-variable example expands the token into the argument vector before starting Node.js, so the environment variable does not prevent exposure through process inspection. Exploitation requires an attacker or monitoring component that can inspect the victim's process arguments, command records, or relevant logs. This issue does not independently provide host privilege escalation. ### Attack Path 1. A user follows the documented command and supplies a valid token through `--token`. 2. The shell expands the token into the Node.js process argument vector. 3. While the process is running, a local user or monitoring service with process-inspe ...[truncated 768 chars]- Remediation
View remediation