T09 · Insecure Skill Coding Practices
Warning
- Location
- twitter-article.js:514
- Finding
- Notion integration token exposed through command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:12`; `twitter-article.js:514-526` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash # SKILL.md:12 node twitter-article.js notion-to-article --notion-key <key> --page-id <id> ``` ```javascript // twitter-article.js:514-526 async function main() { const args = process.argv.slice(2); const cmd = args[0]; const getArg = (name) => { const i = args.indexOf(`--${name}`); return i >= 0 ? args[i + 1] : null; }; try { switch (cmd) { // ... case 'notion-to-article': await cmdNotionToArticle(getArg('notion-key'), getArg('page-id'), { publish: args.includes('--publish') }); break; ``` ### Technical Analysis The documented interface instructs users to supply the Notion integration secret through the `--notion-key` command-line option. The implementation then retrieves that secret directly from `process.argv`. Command-line arguments are not an appropriate channel for secrets because they may be exposed through: - Shell history files. - Process listings and process-monitoring utilities. - Audit, telemetry, debugging, or orchestration logs that record command lines. - Wrapper scripts, job definitions, or CI logs containing the full invocation. - Error reports or administrative tooling that captures process metadata. The Notion token is legitimately required for the declared Notion-to-Twitter synchronization operation, and the code sends it only to the official Notion API. The vulnerability is therefore not unauthorized network exfiltration; it is insecure local credential handling that unnecessarily broadens access to the token. ### Attack Path 1. A user follows the documented example and runs the Skill with `--notion-key <secret>`. 2. The secret becomes part of the process command line and may also be written to shell history. 3. A local user, process-monitoring service, CI logger, o ...[truncated 821 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove support for passing the Notion token directly through `--notion-key`, or retain it only with a prominent deprecation warning. 2. Read the token from a dedicated environment variable, such as `NOTION_TOKEN`: ```javascript const notionKey = process.env.NOTION_TOKEN; if (!notionKey) { throw new Error('NOTION_TOKEN is required'); } ``` 3. For interactive use, support a hidden terminal prompt that does not echo the token. 4. In automated environments, retrieve the token from the platform's secret manager rather than storing it in scripts or job arguments. 5. Update `SKILL.md` to recommend secure secret injection: ```bash export NOTION_TOKEN="<notion integration token>" node twitter-article.js notion-to-article --page-id <id> ``` 6. Advise existing users to remove exposed commands from shell history and rotate any token that may have entered logs. 7. Ensure error messages and diagnostic output never print the token or complete authorization headers. ]]>