T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:153- Finding
Bearer Token Exposed Through the curl Process Argument Vector
- Content
View full analysis
","-1","","--PlainText"]} EOF ``` The same Authorization-header pattern is repeated in the examples at lines 163-168 and 173-178. ### Technical Analysis The shell expands `$LESECURE_API_KEY` before starting `curl`. Consequently, the resulting Authorization header, including the literal bearer token, becomes part of the `curl` process argument vector. This contradicts the Skill's assertion that referencing the environment variable inside the curl command prevents the key from appearing on the command line. Although the JSON request body is supplied through standard input, the Authorization header remains an ordinary command-line argument. Depending on the operating system's process-inspection restrictions, the expanded token may be visible through process-monitoring interfaces, diagnostic tooling, endpoint monitoring, process accounting, crash reports, or logs that record command arguments. ### Attack Path 1. A user invokes an encryption or decryption workflow described by the Skill. 2. The shell expands `$LESECURE_API_KEY` into the Authorization-header argument. 3. `curl` starts with the complete bearer token in its process argument vector. 4. A local user, compromised monitoring agent, or process-inspection tool captures the argument while `curl` is running. 5. The attacker extracts the bearer token. 6. The attacker reuses the token to submit requests to the LESecure API until the token is revoked or expires. ### Impact Assessment Successful exploitation discloses the API bearer token. An attacker may obtain the same LESecure API authorization granted to that token, potentially ...[truncated 334 chars]- Remediation
View remediation