T09 · Insecure Skill Coding Practices
- Location
scripts/helper.py:194- Finding
UApp Credentials Exposed Through URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
scripts/helper.py:194-198andscripts/helper.py:221-224
Vulnerability Type: Credentials transmitted in URL query parameters
Risk Level: HighVulnerable Code
python params = { 'ak': self.ak, 'sk': self.sk, 'appkey': appkey, 'ds': date } response = requests.get(url, params=params, headers=self.headers) response.raise_for_status()python params = { 'ak': self.ak, 'sk': self.sk } response = requests.get(url, params=params, headers=self.headers) response.raise_for_status()The same authentication design is documented in
SKILL.md:75-88andSKILL.md:110-122.Technical Analysis
The API key and API security token are supplied through the
paramsargument. Therequestslibrary consequently constructs URLs containing values such as:text https://mobile.umeng.com/ht/api/v3/ai/getYesterdayOutliers?ak=API_KEY&sk=SECURITY_TOKENHTTPS protects the URL while it is in transit, but it does not prevent the complete URL from being recorded by application diagnostics, HTTP proxies, gateways, server access logs, monitoring systems, or exception handlers.
This exposure is compounded by
response.raise_for_status(). AnHTTPErrorgenerated for a failed response can contain the request URL. The top-level exception handler atscripts/helper.py:379-381prints exception text to standard error:python except Exception as e: print(f"Error: {e}", file=sys.stderr) sys.exit(1)As a result, an HTTP failure may place both credentials in terminal output, CI/CD logs, agent transcripts, or centralized log storage.
Attack Path
- A user runs an outlier-report or yesterday-outliers request with valid UApp credentials.
- The script places
akandskinto the request URL. - An attacker, network intermediary, service failure, or invalid request causes the endpoint to ...[truncated 1072 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer an authorization header or protected request body instead of URL query parameters whenever supported by the UApp API.
- If the remote API requires query-string authentication, catch
requests.HTTPErrorexplicitly and never print the generated exception or prepared request URL directly. - Construct sanitized errors using only the HTTP status code and a bounded, reviewed response message:
python try: response.raise_for_status() except requests.HTTPError: raise RuntimeError( f"UApp request failed with HTTP status {response.status_code}" ) from None - Add a centralized redaction function that removes
ak,sk,Authorization, and bearer-token values from logs and errors. - Disable verbose HTTP and proxy logging for authenticated requests, or configure those systems to redact sensitive query parameters.
- Review CI/CD, terminal, proxy, gateway, and server logs for prior exposure. Rotate credentials if credential-bearing URLs may have been retained.
- Add automated tests that trigger non-successful HTTP responses and verify that neither credential appears in standard output, standard error, exceptions, or logs.