T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/animate.sh:38- Finding
API Key Exposed Through Command-Line Arguments
- Content
View full analysis
[PROMPT] [OUTPUT_PATH] ``` ```bash API_KEY="${1:-${AOP_API_KEY:-}}" ``` The unsafe interface is also promoted in the documentation: ```bash bash scripts/animate.sh [PROMPT] [OUTPUT_PATH] ``` ```bash bash scripts/animate.sh aop_xxxx ./grandma.jpg "gentle smile and slight head turn" ./result.mp4 ``` ### Technical Analysis The script accepts the paid-service API key as its first positional command-line argument. Command-line arguments can be exposed through shell history, process inspection utilities, terminal or session recordings, job-control systems, agent execution traces, and centralized telemetry. Although the script supports the `AOP_API_KEY` environment variable as a fallback, its primary usage syntax and examples explicitly encourage users to place the credential on the command line. The environment-variable example also expands the secret into an argument: ```bash bash scripts/animate.sh "$AOP_API_KEY" ./grandma.jpg ``` Consequently, that example does not avoid command-line process exposure. ### Attack Path 1. A user follows the documented example and supplies the API key as the first script argument. 2. The complete command may be saved in shell history or captured by terminal, agent, or job-execution logs. 3. While the script is running, another sufficiently privileged local process may inspect its command-line arguments. 4. An attacker or unauthorized log reader extracts the API key. 5. The attacker submits the key to the Animate Old Photos authentication endpoint. 6. If the key remains valid, the attacker can consume the victim's paid credits and perform operations authorized by that key. ### Impact Assessment Successful ex ...[truncated 397 chars]- Remediation
View remediation