T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:56- Finding
Live API credentials exposed through command-line arguments
- Content
View full analysis
SK= PP= name=live ``` ### Technical Analysis The documented profile-creation command instructs users to substitute a live API key, secret, and passphrase directly into command-line arguments. Depending on the operating system and shell configuration, those values may be exposed through: - Shell history files - Process-listing and process-monitoring tools - Terminal session recordings - Diagnostic or support logs - Audit frameworks that record executed commands The use of a live profile increases the sensitivity of this exposure. Although the Skill describes its news commands as read-only, the effective permissions associated with the supplied API credentials are determined by the credential configuration and the external CLI. The audited files do not establish that those credentials are technically restricted to read-only news access. ### Attack Path 1. The user follows the documented setup procedure and replaces the placeholders with live credentials. 2. The shell records the complete command in its history, or the operating system temporarily exposes the arguments through process metadata. 3. A local attacker, malicious process, monitoring service, or person with access to captured terminal logs retrieves the API key, secret, and passphrase. 4. The attacker attempts to authenticate to OKX using the recovered credentials. 5. The resulting access is bounded by the permissions, account restrictions, IP allowlist, and other controls configured for those credentials. ### Impact Assessment Successful exploitation may disclose all three authentication components needed by the external CLI. An attacker could obtain whatever API privileges were assigned to the exposed credentials. The precise scope cannot be ...[truncated 392 chars]- Remediation
View remediation