T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/joycreator.py:562
- Finding
- JoyCreator App Key Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/joycreator.py`, lines 562–568 **Vulnerability Type**: Credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```python parser.add_argument("--api-key") parser.add_argument("--duration", default="5") parser.add_argument("--aspect-ratio", default="16:9") parser.add_argument("--image-url") args = parser.parse_args() app_key = args.api_key or os.environ.get("JOYCREATOR_APP_KEY","").strip() ``` ### Technical Analysis The script permits users to provide the JoyCreator App Key through the `--api-key` command-line option. Command-line arguments are not an appropriate secret-transport mechanism because they may be exposed through: - Shell history files - Process inspection utilities and process metadata - CI/CD job logs and command tracing - Monitoring or endpoint-management agents - Terminal session recordings - Crash diagnostics and automation telemetry The supplied value is subsequently placed in the `Authorization: Bearer` request header and therefore represents a reusable API credential. Although transmission to the fixed JoyCreator HTTPS endpoint is necessary for the declared functionality, accepting the credential on the command line creates an avoidable local disclosure channel and exceeds the minimum safe credential-handling requirements. ### Attack Path 1. A user invokes the script with a command such as `python scripts/joycreator.py --api-key SECRET ...`. 2. The complete command is retained in shell history, captured by CI logging, or exposed through process metadata while the script is running. 3. A local user, monitoring service, log reader, or compromised automation component retrieves the App Key. 4. The attacker supplies the stolen key as a Bearer credential to the JoyCreator API. 5. The attacker submits generation tasks under the victim's account until the key is revoked or otherwise restricted. This pat ...[truncated 696 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `--api-key` command-line option entirely. 2. Obtain the key only from the `JOYCREATOR_APP_KEY` environment variable, a protected secret manager, or hidden interactive input through `getpass.getpass()`. 3. For CI/CD usage, inject the key through the platform's masked secret mechanism and ensure command tracing is disabled around secret handling. 4. Update documentation to explicitly prohibit placing App Keys in command lines, source files, shell scripts, or unprotected configuration files. 5. Avoid logging request headers or complete request objects in future changes. 6. Recommend key rotation for users who previously supplied credentials through `--api-key`, especially where shell history or build logs may be accessible. 7. Where supported by JoyCreator, use narrowly scoped, short-lived, quota-limited credentials to reduce the impact of disclosure.