T09 · Insecure Skill Coding Practices
Warning
- Location
- tradingcardgenerator.js:16
- Finding
- API Token Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `tradingcardgenerator.js:16-21`, `tradingcardgenerator.js:29-38`, `SKILL.md:16-20`, `SKILL.md:26`, `README.md:25`, `README.md:30`, `README.md:36`, `README.md:42`, `README.md:61-67` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```javascript function parseArgs(argv) { const args = { size: 'portrait', token: null, ref: null, prompt: null }; const rest = []; for (let i = 0; i < argv.length; i++) { const a = argv[i]; if (a === '--size') args.size = argv[++i]; else if (a === '--token') args.token = argv[++i]; else if (a === '--ref') args.ref = argv[++i]; else rest.push(a); } if (rest.length > 0) args.prompt = rest.join(' '); return args; } async function main() { const argv = process.argv.slice(2); const { size, token: tokenFlag, ref, prompt: promptArg } = parseArgs(argv); const TOKEN = tokenFlag; if (!TOKEN) { console.error('\n✗ Token required. Pass via: --token YOUR_TOKEN'); console.error(' Get yours at: https://www.neta.art/open/'); process.exit(1); } ``` The documented invocation reinforces this unsafe credential-passing mechanism: ```bash node tradingcardgenerator.js "your description here" --token YOUR_TOKEN ``` ### Technical Analysis The application requires the Neta API token to be supplied as a command-line argument. Command-line arguments are not an appropriate secret transport mechanism because they may be: - Recorded in interactive shell history. - Visible to local process-inspection utilities while the process is running. - Collected by process-monitoring, diagnostic, audit, or telemetry systems. - Retained in terminal logs, scripts, CI job definitions, or command transcripts. The implementation does not offer a safer alternative such as an environment variable, protected configuration fil ...[truncated 1431 chars]
- Remediation
- ## Remediation Suggestions 1. Add support for a dedicated environment variable, such as `NETA_API_TOKEN`, and make it the preferred authentication mechanism. 2. Support reading the token from a permission-restricted configuration file or secret manager when used in automated environments. 3. For interactive use, accept the token through a hidden prompt that does not echo input or enter shell history. 4. Deprecate and eventually remove `--token`. If backward compatibility requires retaining it temporarily, display a warning explaining the exposure risk. 5. Ensure errors, debug logs, telemetry, and exception reports never include request headers or token values. 6. Update `README.md` and `SKILL.md` so their primary examples use the safer mechanism, for example: ```bash export NETA_API_TOKEN='...' node tradingcardgenerator.js "your description here" ``` 7. Recommend immediate token rotation if a token has already been committed to scripts, logs, or shared shell history.