T09 · Insecure Skill Coding Practices
Warning
- Location
call_aida_app.py:42- Finding
Bearer token may be exposed through command-line arguments and environment variables
- Content
View full analysis
--query "<用户提供的query>" --inputs '<用户提供的inputs的JSON字符串>' ``` It also recommends exporting the token into the process environment: ```bash export AIDA_APPID="your-app-id" export AIDA_INPUTS='{"key": "value"}' export AIDA_QUERY="optional query" export AIDA_USER="your-username" ``` ### Technical Analysis The project identifies `appid` as a bearer token but supports and documents passing it as a command-line argument. Command-line arguments can be retained in shell history and may be visible through process inspection, CI job logs, terminal recording, monitoring agents, or diagnostic reports. Environment variables are safer than command-line arguments in some environments but remain vulnerable to inheritance by child processes, accidental diagnostic dumps, CI configuration exposure, and access by sufficiently privileged local processes. Several stdin examples use `echo` with the toke ...[truncated 1620 chars]- Remediation
View remediation