T09 · Insecure Skill Coding Practices
- Location
SKILL.md:43- Finding
API Key Exposure Through URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 43 and 203–214
Vulnerability Type: API key exposure through query-string authentication
Risk Level: MediumVulnerable Code
markdown | Query 参数 | `?apikey=YOUR_API_KEY` |bash curl -X GET "https://api.followin.io/open/feed/list/trending?type=hot_news&count=15&lang=en&apikey=YOUR_API_KEY" curl -X GET "https://api.followin.io/open/feed/news?count=20&lang=en&apikey=YOUR_API_KEY" curl -X GET "https://api.followin.io/open/channel/feeds?code=macro&count=20&last_cursor=0&lang=en&apikey=YOUR_API_KEY" curl -X GET "https://api.followin.io/open/channel/feeds/card?count=20&last_cursor=0&lang=en&apikey=YOUR_API_KEY"Technical Analysis
The Skill explicitly supports placing an API key in the request URL and uses that authentication method in most examples. Although the committed value is only the placeholder
YOUR_API_KEY, users or agents following these examples may replace it with a real credential.Query strings are frequently retained in shell history, command-line telemetry, application and reverse-proxy access logs, monitoring platforms, debugging output, and copied URLs. HTTPS protects the URL while it is transmitted over the network, but it does not prevent credential disclosure through endpoint or server-side logging.
Header-based authentication is also documented, but it is not established as the preferred or required method.
Attack Path
- A user or agent follows one of the documented
curlexamples. - The placeholder is replaced with a valid Followin API key.
- The complete command or request URL is retained in shell history, process telemetry, proxy logs, API access logs, monitoring data, or diagnostic output.
- An attacker or unauthorized operator with access to one of those records extracts the key from the
apikeyparameter. - The attacker submits requests to
https://api.followin.iousing the recovered credential. - Access continues until the ke ...[truncated 534 chars]
- A user or agent follows one of the documented
- Remediation
View remediation
Remediation Suggestions
- Remove query-string authentication from the documentation and all command examples.
- Require credentials to be transmitted using the
Authorizationheader. - Read the key from a protected environment variable rather than embedding it directly in commands:
bash curl --fail-with-body --silent --show-error \ -H "Authorization: ${FOLLOWIN_API_KEY}" \ "https://api.followin.io/open/feed/list/trending?type=hot_news&count=15&lang=en"- Advise users to configure the environment variable through an appropriate secret manager and to avoid committing it to source control.
- Ensure environment files containing credentials are excluded from version control and protected with restrictive filesystem permissions.
- Configure API gateways, proxies, and monitoring systems to redact authorization data.
- Rotate any API key that has previously been placed in a URL or exposed in shell history or logs.
- Where supported by the service, apply expiration, least-privilege scopes, usage limits, and source restrictions to API keys.