T09 · Insecure Skill Coding Practices
- Location
ollama-web-search.sh:148- Finding
API Key Exposed Through curl Process Arguments
- Content
View full analysis
Vulnerability Details
File Location:
ollama-web-search.sh, lines 148–155 and 246–253
Vulnerability Type: API credential exposure through process arguments
Risk Level: MediumVulnerable Code
Search request at lines 148–155:
bash HTTP_CODE=$(curl -s -o "$TEMP_DIR/response.txt" -w "%{http_code}" \ --max-time "$TIMEOUT_SECONDS" \ -X POST "https://ollama.com/api/web_search" \ --header "Authorization: Bearer $OLLAMA_API_KEY" \ --header "Content-Type: application/json" \ -d "$JSON_PAYLOAD" 2>/dev/null || echo "000")Fetch request at lines 246–253:
bash HTTP_CODE=$(curl -s -o "$TEMP_DIR/response.txt" -w "%{http_code}" \ --max-time "$TIMEOUT_SECONDS" \ -X POST "https://ollama.com/api/web_fetch" \ --header "Authorization: Bearer $OLLAMA_API_KEY" \ --header "Content-Type: application/json" \ -d "$JSON_PAYLOAD" 2>/dev/null || echo "000")Technical Analysis
The shell expands
OLLAMA_API_KEYbefore starting curl, placing the complete bearer token in curl's argument vector as part of theAuthorizationheader. On systems where another local process can inspect that process's command-line arguments, the token may be visible through process-monitoring tools or process metadata such as/proc.The
safe_errorredaction function only removes the key from application-generated error messages. It does not protect the argument vector, so it does not mitigate this exposure.Sending an API credential to the fixed Ollama HTTPS endpoints is necessary and consistent with the Skill's declared search and fetch functionality. The vulnerability is specifically the local method used to pass that credential to curl, not the documented network transmission itself.
Exploitability depends on operating-system process-visibility controls, the attacker's local access, and whether the attacker can observe the relatively short-lived curl process.
Attack Path
- A vict ...[truncated 1021 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not place the bearer token directly in curl's command-line arguments.
- Supply the sensitive header through a permission-restricted temporary curl configuration file or another mechanism that does not expose the token in the argument vector.
- Create any credential-bearing temporary file with restrictive permissions, such as mode
0600, and retain the existing cleanup trap. - Keep the authorization value out of logs, diagnostic traces, shell tracing, and error output.
- Consider disabling shell tracing around credential handling if the script may run in environments using
set -x. - Document that users should issue narrowly scoped API keys where supported and rotate the key immediately if local exposure is suspected.
- Add a regression test that executes the request while examining curl's visible argument vector and verifies that the token does not appear.