T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/linear_json.sh:41
- Finding
- Linear API Key Exposed Through Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/linear_json.sh:41-44` **Vulnerability Type**: Sensitive credential exposure through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```bash curl -sS -X POST "$API" \ -H "Content-Type: application/json" \ -H "Authorization: $LINEAR_API_KEY" \ -d "$payload" ``` ### Technical Analysis The script expands `LINEAR_API_KEY` directly into a `curl` command-line argument. Although sending an authorization credential to Linear's official API is necessary for the adapter's declared functionality, placing the credential in an argument can expose it through process metadata. Depending on operating-system configuration, other local users, monitoring agents, diagnostic tools, or processes with access to `/proc` or process-listing interfaces may be able to observe the complete `curl` argument vector while the request is running. The exposure is brief but repeats whenever the Linear adapter performs a request. The destination, `https://api.linear.app/graphql`, is the official Linear API endpoint; no evidence of credential exfiltration to an unrelated endpoint was found. The vulnerability concerns the local handling of the credential before transmission. ### Attack Path 1. The victim configures `LINEAR_API_KEY` and invokes a Linear-backed workflow operation. 2. `scripts/linear_json.sh` starts `curl` and expands the API key into the `Authorization` header argument. 3. A malicious or compromised local process repeatedly inspects process arguments using an available process-listing or `/proc` interface. 4. The observer captures the authorization argument while `curl` is active. 5. The attacker reuses the captured API key against the Linear API. Successful exploitation requires local access sufficient to inspect the victim process's argument vector. ### Impact Assessment An attacker who obtains the key can exercise the Linear permissions granted to that token. Depending on its scope, th ...[truncated 355 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not place authorization credentials directly in command-line arguments. - Pass a protected `curl` configuration through standard input or a restricted file descriptor, for example by using `curl --config -` and writing the sensitive header to stdin. - If a temporary configuration file is unavoidable, create it with owner-only permissions, avoid predictable paths, and delete it reliably after use. - Ensure errors and diagnostic logs never print the generated authorization configuration. - Use a dedicated, least-privilege Linear token limited to the required teams, projects, and operations. - Prefer short-lived credentials where supported and document a token-rotation and revocation procedure. - Add a regression test or static check that rejects direct expansion of `LINEAR_API_KEY` into executable argument arrays. ]]>