T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/taapi-agent.sh:143
- Finding
- TAAPI Secret Exposed Through URL Arguments and Error Messages## Vulnerability Details **File Location**: `scripts/taapi-agent.sh`, lines 143, 154, 168–177, and 225–227 **Vulnerability Type**: Credential disclosure through query strings, process arguments, and diagnostic output **Risk Level**: Medium ### Vulnerable Code ```bash if [[ "$status" == "429" || "$status" =~ ^5[0-9][0-9]$ ]]; then if (( attempt <= retries )); then sleep "$attempt" continue fi fi echo "$body" >&2 die "http status $status from $url" ``` ```bash cat "$tmpfile" >&2 || true die "curl failed for $url" ``` ```bash build_direct_url() { local indicator="$1" shift local q="secret=$(urlencode "$SECRET")" local kv for kv in "$@"; do local k="${kv%%=*}" local v="${kv#*=}" q+="&$(urlencode "$k")=$(urlencode "$v")" done printf '%s/%s?%s' "$BASE_URL" "$indicator" "$q" } ``` ```bash local url body url="$(build_direct_url "$indicator" "${query[@]}")" body="$(http_with_retries "GET" "$url" "" "$retries" "$timeout")" render_output "$body" "$output_mode" ``` ### Technical Analysis The `direct` command constructs a URL whose query string contains the URL-encoded `TAAPI_SECRET`. That complete URL is then passed to `curl` as a command-line argument. Depending on the operating system and process-monitoring configuration, another local user or monitoring agent may be able to observe it through process listings. The same complete URL is interpolated into error messages after an HTTP failure or terminal curl failure. Consequently, the secret can be written to stderr and retained in CI logs, terminal recordings, centralized logging platforms, or support diagnostics. URL encoding does not protect the credential because it is reversible transport encoding rather than encryption or redaction. This behavior also weakens the documentation’s recommendation to use `TAAPI_SECRET` instead of `--secret` to reduce process-list exposure: although the initial script arguments omit the secret, the child `curl` command receives a URL that con ...[truncated 1589 chars]
- Remediation
- ## Remediation Suggestions 1. **Redact credentials from all diagnostics.** - Do not print the complete request URL. - Report only the HTTP method, trusted host, endpoint path, and status. - Add a centralized redaction function that removes `secret` query parameters before any URL reaches logs. 2. **Avoid placing the secret in observable process arguments.** - If TAAPI supports it, use an authorization header or request body instead of query-string authentication. - If the direct endpoint strictly requires a query parameter, pass sensitive curl configuration through a protected file descriptor or stdin rather than including the complete URL in `curl` arguments. - Ensure temporary credential-bearing files are created with restrictive permissions and deleted reliably if such files are unavoidable. 3. **Separate safe diagnostic context from transport data.** - Pass a sanitized endpoint label to `http_with_retries` for error reporting rather than reusing the request URL. - Never include credentials in exceptions, retry messages, tracing output, or shell debugging. 4. **Add regression tests.** - Invoke the CLI with a distinctive dummy secret and a controlled failing endpoint. - Capture stdout and stderr and assert that neither contains the raw nor URL-encoded secret. - Where feasible, inspect spawned command arguments in a test harness and verify the credential is absent. 5. **Update the documentation.** - Clarify that environment-variable input alone does not prevent disclosure if the implementation later places the credential in a child process’s arguments. - Recommend credential rotation if a failure log from the affected implementation may have been retained.