T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:130
- Finding
- API Credentials and Contact Data Exposed in URL Query Strings<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:130-139, 194, 209, 230, 258`; `README.md:194`; `TEST_CHECKLIST.md:12, 50` **Vulnerability Type**: Sensitive information exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```markdown All requests require the `SELZY_API_KEY` environment variable. Pass it as the `api_key` parameter. **Base URL:** `https://api.selzy.com/en/api` **Important:** All methods use `GET` with query parameters (Selzy API uses GET for all endpoints). URL-encode parameter values when needed. ## General Request Pattern ```bash curl "https://api.selzy.com/en/api/{METHOD}?format=json&api_key=$SELZY_API_KEY&{params}" ``` ``` Examples also place contact data and email content in the URL: ```bash curl "https://api.selzy.com/en/api/importContacts?format=json&api_key=$SELZY_API_KEY&field_names[]=email&field_names[]=Name&data[][]=john@example.com&data[][]=John&data[][]=jane@example.com&data[][]=Jane&list_ids=12345&overwrite=2" ``` ```bash curl "https://api.selzy.com/en/api/subscribe?format=json&api_key=$SELZY_API_KEY&list_ids=12345&fields[email]=user@example.com&fields[Name]=Alice&double_optin=3" ``` ```bash curl "https://api.selzy.com/en/api/getContact?format=json&api_key=$SELZY_API_KEY&email=user@example.com" ``` ### Technical Analysis The Skill instructs the Agent to authenticate by embedding `SELZY_API_KEY` directly in every request URL. It also embeds subscriber email addresses, names, message bodies, subjects, and other campaign data in query parameters. Although HTTPS encrypts the request during transport, query strings remain vulnerable to disclosure through other channels, including: - Process listings that capture command-line arguments - Shell history and terminal session recording - Debugging or verbose HTTP output - Reverse-proxy, CDN, gateway, and web-server access logs - Monitoring, tracing, crash-reporting, or endpoint-management systems - Copied command output and troubleshoo ...[truncated 1883 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer an authorization header rather than a query parameter if supported by Selzy: ```bash curl \ -H "Authorization: Bearer $SELZY_API_KEY" \ "https://api.selzy.com/en/api/getLists?format=json" ``` 2. Prefer `POST` requests with form or JSON bodies for contact information, message content, and other sensitive parameters whenever the API supports them. 3. If Selzy strictly requires API keys in GET query parameters: - Clearly document that this is an API limitation and that URLs contain secrets. - Avoid examples likely to be copied into persistent shell history. - Disable command tracing such as `set -x` around requests. - Configure HTTP clients, proxies, tracing systems, and application logs to redact `api_key`, `fields`, `data`, `body`, and email parameters. - Do not print complete request URLs in errors or diagnostics. - Use a dedicated restricted client process rather than constructing requests directly in an interactive shell. 4. Store the key in a protected secret manager or a configuration file readable only by the service account. Do not place a real key directly in general-purpose configuration examples without permission-hardening guidance. 5. Use a dedicated Selzy key with the narrowest available permissions and rotate it immediately if a complete request URL is logged or shared. 6. Add automated redaction tests to verify that credentials, contact addresses, and message bodies cannot appear in normal or error logs.]]>