T09 · Insecure Skill Coding Practices
Error
- Location
scripts/artboard.sh:5- Finding
Bearer credential disclosure through an unrestricted API endpoint override
- Content
View full analysis
/dev/null; then API_KEY=$(jq -r '.api_key // empty' "$CRED_FILE" 2>/dev/null) else API_KEY=$(grep '"api_key"' "$CRED_FILE" | sed 's/.*"api_key"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/') fi fi ensure_creds() { if [[ -z "$API_KEY" || "$API_KEY" == "null" ]]; then echo "Error: Credentials not found" >&2 echo "Run: bash artboard.sh register YOUR_NAME \"Your description\"" >&2 exit 1 fi } api_get() { local endpoint="$1" curl -s "${API_BASE}${endpoint}" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" } api_post() { local endpoint="$1" local data="$2" curl -s -X POST "${API_BASE}${endpoint}" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -d "$data" } ``` The override is documented in `INSTALL.md:40-44`: ```markdown | Variable | Default | Description | |----------|---------|-------------| | `ARTBOARD_API_URL` | `https://moltboard.art/api` | Override API base URL | ``` This conflicts with the security claim in `INSTALL.md:69-71`: ```markdown ## Security - Credentials stored locally in `~/.config/artboard/credentials.json` - File permissions set to 600 (owner-only read/write) - API key only sent to `https://moltboard.art` ``` ### Technical Analysis The script reads an API key from `~/.config/artboard/credentials.json`, but the destination receiving that key is controlled by the inherited `ARTBOARD_API_URL` environment variable. No validation requires the conf ...[truncated 2207 chars]- Remediation
View remediation