T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:91- Finding
ScreenshotOne API Key Exposed Through Process Arguments and URL Query Parameters
- Content
View full analysis
" \ --data-urlencode "url=" \ --data-urlencode "access_key=${SCREENSHOTONE_ACCESS_KEY}" \ --data-urlencode "format=png" \ --data-urlencode "=" \ "https://api.screenshotone.com/take" ``` The same credential-handling pattern also appears in the examples at lines 43–46, 54–61, and 70–77. ### Technical Analysis The command expands `SCREENSHOTONE_ACCESS_KEY` directly inside a command-line argument. The expanded plaintext credential can consequently be exposed to local users or processes that are permitted to inspect process command lines. The use of `curl --get` additionally causes all `--data-urlencode` fields, including `access_key`, to be appended to the request URL as query parameters. Although the request is transmitted over HTTPS, query strings can still be recorded by URL-aware components such as API gateway logs, reverse-proxy logs, monitoring systems, debugging output, shell tracing facilities, or provider-side request telemetry. This is an insecure credential-handling pattern because possession of the access key may be sufficient to authenticate ScreenshotOne API requests. No hardcoded credential was found in the repository; the risk arises when the documented command is executed with a real environment variable. ### Attack Path 1. A user exports a valid ScreenshotOne credential in `SCREENSHOTONE_ACCESS_KEY`. 2. The agent executes the documented `curl` command. 3. The shell expands the environment variable into the plaintext `--data-urlencode` process argument. 4. A local attacker with sufficient process-inspection access reads the active curl command line, or an operator retrieves a logged request URL co ...[truncated 1136 chars]- Remediation
View remediation