T09 · Insecure Skill Coding Practices
Warning
- Location
pmxt_trader.py:40- Finding
PMXT API key exposed in process command-line arguments
- Content
View full analysis
dict: if not PMXT_API_KEY: return {"error": "PMXT_API_KEY not set"} payload = json.dumps({"args": [params or {}]}) env = os.environ.copy() r = subprocess.run( ["curl", "-s", "--max-time", "10", f"{PMXT_BASE}/{exchange}/{method}", "-X", "POST", "-H", f"Authorization: Bearer {PMXT_API_KEY}", "-H", "Content-Type: application/json", "-d", payload], capture_output=True, text=True, timeout=12, env=env) ``` ### Technical Analysis The PMXT bearer token is interpolated directly into the `curl` process argument list. Although the code does not invoke a shell and therefore does not introduce shell injection at this location, command-line arguments can be exposed through process inspection facilities, privileged monitoring agents, diagnostic tooling, or process accounting. The child process also inherits a complete copy of the parent environment through `os.environ.copy()`. This grants `curl` access to all environment variables available to the Skill, including unrelated credentials, even though only ordinary networking configuration may be necessary. Sending `PMXT_API_KEY` to the declared HTTPS PMXT endpoint is necessary for the Skill's market-data functionality. The vulnerability is the command-line transport and excessive child-process environment, not the authorized network request itself. ### Attack Path 1. An attacker obtains local process-inspection capability or access to process-monitoring records on the host. 2. The scheduled Skill starts a PMXT request and launches `curl`. 3. The attacker observes the `curl` argument list while the process is active. 4. The Authorization argument r ...[truncated 552 chars]- Remediation
View remediation