T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:43
- Finding
- API Key Exposure Through URL Query Parameters## Vulnerability Details **File Location**: `SKILL.md`, lines 43 and 203–214 **Vulnerability Type**: API key exposure through query-string authentication **Risk Level**: Medium ### Vulnerable Code ```markdown | Query 参数 | `?apikey=YOUR_API_KEY` | ``` ```bash curl -X GET "https://api.followin.io/open/feed/list/trending?type=hot_news&count=15&lang=en&apikey=YOUR_API_KEY" curl -X GET "https://api.followin.io/open/feed/news?count=20&lang=en&apikey=YOUR_API_KEY" curl -X GET "https://api.followin.io/open/channel/feeds?code=macro&count=20&last_cursor=0&lang=en&apikey=YOUR_API_KEY" curl -X GET "https://api.followin.io/open/channel/feeds/card?count=20&last_cursor=0&lang=en&apikey=YOUR_API_KEY" ``` ### Technical Analysis The Skill explicitly supports placing an API key in the request URL and uses that authentication method in most examples. Although the committed value is only the placeholder `YOUR_API_KEY`, users or agents following these examples may replace it with a real credential. Query strings are frequently retained in shell history, command-line telemetry, application and reverse-proxy access logs, monitoring platforms, debugging output, and copied URLs. HTTPS protects the URL while it is transmitted over the network, but it does not prevent credential disclosure through endpoint or server-side logging. Header-based authentication is also documented, but it is not established as the preferred or required method. ### Attack Path 1. A user or agent follows one of the documented `curl` examples. 2. The placeholder is replaced with a valid Followin API key. 3. The complete command or request URL is retained in shell history, process telemetry, proxy logs, API access logs, monitoring data, or diagnostic output. 4. An attacker or unauthorized operator with access to one of those records extracts the key from the `apikey` parameter. 5. The attacker submits requests to `https://api.followin.io` using the recovered credential. 6. Access continues until the ke ...[truncated 534 chars]
- Remediation
- ## Remediation Suggestions 1. Remove query-string authentication from the documentation and all command examples. 2. Require credentials to be transmitted using the `Authorization` header. 3. Read the key from a protected environment variable rather than embedding it directly in commands: ```bash curl --fail-with-body --silent --show-error \ -H "Authorization: ${FOLLOWIN_API_KEY}" \ "https://api.followin.io/open/feed/list/trending?type=hot_news&count=15&lang=en" ``` 4. Advise users to configure the environment variable through an appropriate secret manager and to avoid committing it to source control. 5. Ensure environment files containing credentials are excluded from version control and protected with restrictive filesystem permissions. 6. Configure API gateways, proxies, and monitoring systems to redact authorization data. 7. Rotate any API key that has previously been placed in a URL or exposed in shell history or logs. 8. Where supported by the service, apply expiration, least-privilege scopes, usage limits, and source restrictions to API keys.