T09 · Insecure Skill Coding Practices
- Location
scripts/atomgit.sh:121- Finding
AtomGit bearer token exposed through curl process arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/atomgit.sh:121,scripts/atomgit.sh:131,scripts/atomgit.sh:141, andscripts/atomgit.sh:151
Vulnerability Type: Credential exposure through process arguments
Risk Level: MediumVulnerable Code
bash case "$method" in GET) result=$(curl $SAFE_CURL_OPTS -H "Authorization: Bearer $ATOMGIT_TOKEN" "$url" 2>/dev/null) || true ;; POST) result=$(curl $SAFE_CURL_OPTS -X POST -H "Authorization: Bearer $ATOMGIT_TOKEN" -H "Content-Type: application/json" -d "$data" "$url" 2>/dev/null) || true ;; PUT) result=$(curl $SAFE_CURL_OPTS -X PUT -H "Authorization: Bearer $ATOMGIT_TOKEN" -H "Content-Type: application/json" -d "$data" "$url" 2>/dev/null) || true ;; PATCH) result=$(curl $SAFE_CURL_OPTS -X PATCH -H "Authorization: Bearer $ATOMGIT_TOKEN" -H "Content-Type: application/json" -d "$data" "$url" 2>/dev/null) || true ;; esacTechnical Analysis
The bearer token is expanded by the shell and passed to
curlas part of its argument vector. During request execution, the complete authorization header may therefore be observable through process inspection facilities, monitoring agents, debugging tools, or command-line telemetry.The comment stating that a local variable prevents command-line exposure is inaccurate. Shell variable scope does not affect whether an expanded value is placed in the child process's argument vector.
Exploitation requires local process-observation access or a monitoring service capable of recording process arguments. Operating-system restrictions may reduce exposure between different users, but processes and diagnostic tools operating under the same account commonly retain sufficient visibility.
Attack Path
- A victim configures a privileged
ATOMGIT_TOKEN. - The victim invokes any command that reaches
api_request, such as `merge ...[truncated 886 chars]
- A victim configures a privileged
- Remediation
View remediation
Remediation Suggestions
- Avoid placing authorization headers directly in command-line arguments.
- Use a protected temporary curl configuration file with mode
0600, pass it throughcurl --config, and delete it with a reliabletrap. - Alternatively, use an HTTP client library that accepts headers through in-process APIs rather than the process argument vector.
- Ensure temporary credential material is created with
umask 077and is never written into the workspace or a shared directory. - Disable verbose request tracing around authenticated requests and review process-monitoring systems for argument collection.
- Rotate any token that may already have been exposed and apply minimum necessary AtomGit scopes.