T09 · Insecure Skill Coding Practices
- Location
scripts/youtube_search.py:18- Finding
YouTube API key disclosure through HTTP error output
- Content
View full analysis
Vulnerability Details
File Location:
scripts/youtube_search.py, lines 18–29 and 58–63
Vulnerability Type: Sensitive credential exposure through exception serialization
Risk Level: MediumVulnerable Code
python params = { "part": "snippet", "q": query, "type": "video", "maxResults": min(limit, 50), "order": order, "key": api_key, } with get_client() as client: resp = client.get(API_URL, params=params) resp.raise_for_status() data = resp.json()python try: items = search(args.query, args.limit, api_key, args.order) print_json(make_result(True, args.query, "youtube", items)) except Exception as e: print_json(make_result(False, args.query, "youtube", [], str(e))) sys.exit(1)Technical Analysis
The YouTube API key is placed in the request query string as
key. Whenraise_for_status()raises anhttpx.HTTPStatusError, its string representation can contain the complete request URL. The broad exception handler then serializesstr(e)directly into the program's JSON output.Consequently, an HTTP failure may place the API key in standard output. Although sending the key to Google's documented HTTPS API is required for the declared search functionality, reproducing that key in application output is not required and exceeds minimum credential exposure.
Attack Path
- A user supplies a valid YouTube API key through
YOUTUBE_API_KEYor--api-key. - The script sends a search request with the key in the URL query string.
- Google or an intermediary returns an HTTP error, such as a quota, authorization, or malformed-request response.
resp.raise_for_status()raises an exception associated with the complete request URL.- The broad exception handler converts the exception to a string without redaction.
- The resulting JSON error is written to stdout and may be retained by agent transcripts, ...[truncated 460 chars]
- A user supplies a valid YouTube API key through
- Remediation
View remediation
Remediation Suggestions
- Do not return raw exception strings to users or agent output.
- Catch
httpx.HTTPStatusErrorseparately and emit only a sanitized status code and generic message. - Remove or redact sensitive query parameters before logging request URLs.
- Use a centralized error-sanitization function that replaces values for parameters such as
key,token, andauthorization. - Restrict the Google API key to the YouTube Data API, enforce applicable source restrictions, and configure quota alerts.
- Rotate any key that may already have appeared in logs.
Example:
python except httpx.HTTPStatusError as exc: error = f"YouTube API request failed with HTTP {exc.response.status_code}" print_json(make_result(False, args.query, "youtube", [], error)) sys.exit(1) except Exception: print_json(make_result(False, args.query, "youtube", [], "YouTube search failed")) sys.exit(1)