T09 · Insecure Skill Coding Practices
- Location
client.js:7- Finding
Team API Key Exposed Through Command-Line Arguments
- Content
View full analysis
Vulnerability Details
File Location:
client.js:7-19, 48; documented usage inSKILL.md:24, 43-59, 66, 68
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: MediumComplete Code Snippet
js export function parseArgs(argv) { const args = {}; for (let i = 2; i < argv.length; i += 1) { const token = argv[i]; if (!token.startsWith("--")) continue; const key = token.slice(2); const next = argv[i + 1]; if (!next || next.startsWith("--")) { args[key] = true; continue; } args[key] = next; i += 1; } return args; }js export function buildRequestOptions(args) { return { apiKey: getOption(args, "api-key"), baseUrl: normalizeBaseUrl( getOption(args, "base-url", false, "https://api.socialecho.net") ), teamId: getOption(args, "team-id", false, ""), lang: getOption(args, "lang", false, "zh_CN") }; }The documented invocation pattern includes:
bash ./team.js --api-key YOUR_KEY ./publish-article.js --api-key YOUR_KEY --payload ./publish-payload.example.json --execute --confirm-account-id 163751 ./tiktokshop-product-sync.js --api-key YOUR_KEY --account-id 43 --execute --confirm-account-id 43Technical Analysis
The Team API key is required as a
--api-keycommand-line argument and is read directly fromprocess.argv. Secrets passed this way can be exposed through shell history, process inspection facilities, endpoint-monitoring software, audit logs, terminal recording, or automation logs.This handling also conflicts with the security guidance in
SKILL.md:12, which states that the key must never be persisted and specifically identifies shell history as a sensitive source. The implementation does not intentionally transmit the credential to unrelated hosts—the HTTP client restricts destinations to approved HTTPS SocialEch ...[truncated 1679 chars]- Remediation
View remediation
Remediation Suggestions
- Remove support for supplying API keys directly through ordinary command-line arguments.
- Read the key from standard input or a dedicated file descriptor, ensuring the value does not appear in process arguments.
- For interactive use, employ a hidden prompt with terminal echo disabled.
- For automation, accept the secret through a protected secret manager integration or inherited file descriptor rather than a command string.
- Update every example in
SKILL.mdso no example encourages secret-bearing command lines. - Avoid printing the key in errors, debug logs, request traces, dry-run previews, or serialized option objects.
- Document key rotation and revocation procedures for users who may already have exposed keys through shell history or logs.
- Apply narrowly scoped server-side permissions and short key lifetimes where supported, limiting the impact of credential disclosure.
- Add automated tests confirming that process arguments and normal output do not contain the supplied credential.