T09 · Insecure Skill Coding Practices
Error
- Location
scripts/vk_cli.js:12- Finding
Privileged VK access tokens are exposed through command-line arguments and URL query parameters
- Content
View full analysis
"Message text" [attachments] ``` It also recommends constructing a URL containing the token: ```bash curl "https://api.vk.com/method/METHOD_NAME?access_token=TOKEN&v=5.131&PARAM1=VALUE1" ``` ### Technical Analysis The CLI accepts a VK access token as a positional process argument. Command-line secrets can be retained in shell history and may be observable through process-inspection facilities by other processes or users, subject to operating-system permissions. The `callVk` function then places the token in the URL query string. Other sensitive parameters, including message contents, are also encoded into the query string because every API parameter is appended to `url.searchParams`. Although HTTPS protects the URL from ordinary network interception in transit, complete URLs can still be exposed through application diagnostics, HTTP client instrumentation, endpoint monitoring, proxy logs, or improperly configured logging infrastructure. This issue is especially significant because the documentation recommends persistent, broadly privileged user tokens. Disclosure could therefore provide long-term access t ...[truncated 1495 chars]- Remediation
View remediation
` positional arguments with secure environment-variable or stdin-based examples. 7. Remove the token-bearing `curl` URL example. If a raw request example is necessary, demonstrate a protected variable and POST body while warning users about shell history. 8. Add automated tests that verify tokens do not appear in generated URLs, console output, or thrown error messages. 9. Recommend immediate token revocation and rotation if a token has been entered into shared terminals, recorded sessions, or exposed logs. ]]>