T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/downloader.py:130- Finding
API Key Exposure Through Command-Line Arguments
- Content
View full analysis
" --api-key ark_your_key` | | **Config File** | `echo '{"api_key":"ark_your_key"}' > ~/.qoder/apis/redfox.json` | ``` ```python parser.add_argument("--api-key", help="API Key (format ark_xxx; falls back to env var or config file if not provided)") ``` ### Technical Analysis The Skill accepts and documents passing the RedFox API key directly through the `--api-key` command-line argument. Command-line arguments are not an appropriate secret-delivery mechanism because they may be: - Stored in shell history. - Visible to local process-monitoring or diagnostic utilities. - Recorded by process accounting, audit, telemetry, or support tools. - Copied into terminal logs, automation logs, or command transcripts. Although environment-variable and permission-restricted configuration-file methods are also available, documenting the CLI method encourages users to expose credentials unnecessarily. ### Attack Path 1. A user follows the documented example and invokes the script with `--api-key ark_secret`. 2. The complete command is stored in shell history or exposed through process metadata while the script is running. 3. Another local user, monitoring service, diagnostic collector, or party with access to the command history obtains the API key. 4. The exposed key is reused to make unauthorized RedFox API requests until it expires or is revoked. ### Impact Assessment An attacker who recovers the key can act with the API permissions assigned to that credential. This may allow unauthorized API consumption, exhaustion of quotas or paid credits, and access to any RedFox func ...[truncated 204 chars]- Remediation
View remediation