T09 · Insecure Skill Coding Practices
Warning
- Location
client.js:46- Finding
Team API Key Exposed Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:24-25, 43-59, 66-68;client.js:46-52
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: MediumVulnerable Code
SKILL.md:24-25:markdown - `--api-key` (required) - `--base-url` (optional; only the SocialEcho production or development API host is accepted, default `https://api.socialecho.net`)SKILL.md:43-59:markdown ./team.js --api-key YOUR_KEY ./account.js --api-key YOUR_KEY --page 1 --type 1 ./oauth-links.js --api-key YOUR_KEY ./article.js --api-key YOUR_KEY --page 1 --account-ids 41,42 ./report.js --api-key YOUR_KEY --start-date 2026-01-01 --end-date 2026-03-24 --time-type 1 --group day --account-ids 41,42 ./upload-url.js --api-key YOUR_KEY --content-type image/png # Or: --content_type video/mp4 ./reddit-communities.js --api-key YOUR_KEY --account-id 163751 ./pinterest-boards.js --api-key YOUR_KEY --account-id 163751 ./tiktokshop-products.js --api-key YOUR_KEY --account-id 43 --page 1 --per-page 20 ./tiktokshop-music-genres.js --api-key YOUR_KEY ./tiktokshop-music-trending.js --api-key YOUR_KEY --account-id 43 --country-code US --genre BGM --date-range 7DAYSKILL.md:64-68:markdown ./publish-article.js --payload ./publish-payload.example.json ./publish-article.js --api-key YOUR_KEY --payload ./publish-payload.example.json --execute --confirm-account-id 163751 ./tiktokshop-product-sync.js --account-id 43 ./tiktokshop-product-sync.js --api-key YOUR_KEY --account-id 43 --execute --confirm-account-id 43client.js:46-52:js export function buildRequestOptions(args) { return { apiKey: getOption(args, "api-key"), baseUrl: normalizeBaseUrl(getOption(args, "base-url", false, "https://api.socialecho.net")), teamId: getOption(args, "team-id", false, ""), lang: getOption(args, "lang", false, "zh_CN") }; } ...[truncated 2840 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
--api-keyas the recommended credential transport mechanism. - Add an interactive hidden prompt that reads the key without echoing it when standard input is attached to a terminal.
- Support reading the key from standard input for automated use, preferably through an explicit option such as
--api-key-stdin. - If environment-variable support is necessary for CI/CD, use a narrowly scoped variable and document that the CI secret store must mask it. Avoid printing inherited environment data.
- Preserve the existing destination allowlist so credentials can only be sent to approved HTTPS hosts.
- Update every command example to avoid placing real credentials in command arguments.
- Ensure errors, debug output, telemetry, and request logging redact the
Authorizationheader and any credential-bearing input. - Recommend immediate key rotation for users who previously supplied real keys through command lines, shared scripts, or logged CI jobs.
- Add automated tests confirming that credentials are never included in standard output, standard error, URLs, dry-run previews, or thrown error messages.
- Remove