T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/revenue.py:105
- Finding
- Stripe Secret Key Exposed in Process Command-Line Arguments in Revenue Reporting<![CDATA[ ## Vulnerability Details **File Location**: `scripts/revenue.py`, lines 105-112 **Vulnerability Type**: Stripe credential disclosure through process arguments **Risk Level**: Medium ### Vulnerable Code ```python headers = ["-u", f"{stripe_key}:", "-H", "Stripe-Version: 2025-01-27.acacia"] if acct_id: headers.extend(["-H", f"Stripe-Account: {acct_id}"]) all_data = [] url = f"https://api.stripe.com/v1/{endpoint}" while url: result = subprocess.run( ["curl", "-s", "-g", url] + headers, capture_output=True, text=True ) ``` ### Technical Analysis The code passes the Stripe secret key to `curl` using the `-u` argument. Although `subprocess.run` uses an argument list rather than a shell and therefore does not introduce shell injection here, the secret becomes part of the child process's command-line argument vector. Depending on operating-system process visibility, container configuration, monitoring software, and local account permissions, another process may observe this argument through process inspection facilities such as `/proc/<pid>/cmdline`, `ps`, audit logs, endpoint monitoring, or process telemetry. The credential remains exposed for the lifetime of each `curl` process. Pagination and multi-account reporting can create multiple opportunities to observe it. The key is a Stripe secret rather than a restricted ephemeral token. Its effective authority depends on how the key was provisioned. ### Attack Path 1. An attacker first obtains local code execution or process-inspection access on the host, under an account permitted to inspect the reporting process. 2. The attacker monitors process creation or repeatedly queries available process metadata. 3. A user or scheduled workflow invokes `scripts/revenue.py`. 4. The script starts `curl` with `-u sk_...:` in its process argument vector. 5. The attacker captures the argument vector and extracts the Stripe secret key. 6. The attacker sends authenticated requests to Strip ...[truncated 900 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the external `curl` process with a vetted in-process Stripe SDK or HTTPS client. 2. Supply authentication through an HTTP `Authorization` header managed in process memory, not through command-line arguments. 3. Use a restricted Stripe key granting only the read operations required for revenue reporting. 4. Verify that `~/.config/stripe/api_key` is a regular file owned by the expected user and has restrictive permissions such as mode `0600`. 5. Avoid logging request headers, authorization values, environment dumps, or exception objects that could contain the key. 6. Rotate the existing Stripe key if the script has run on a shared or monitored host where process arguments may have been retained. 7. If retaining `curl` temporarily is unavoidable, provide credentials through a protected mechanism that does not expose them in the argument vector; an in-process client remains the preferred correction. ]]>