T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:23
- Finding
- Stripe API Key Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 23-24 **Vulnerability Type**: Secret exposure through process arguments **Risk Level**: Medium ```bash # Setup Stripe ./billing.sh stripe --key $STRIPE_KEY ``` ### Technical Analysis The documented command expands the `STRIPE_KEY` environment variable and passes its value to `billing.sh` as a command-line argument. Secrets supplied this way may become visible in process listings, shell debugging output, audit records, monitoring telemetry, wrapper logs, crash reports, or command histories where the expanded command is recorded. The referenced `billing.sh` file is not included in the audited project, so its handling of the key cannot be assessed. Nevertheless, the documented invocation pattern itself encourages insecure secret handling. ### Attack Path 1. A user stores a valid Stripe API key in the `STRIPE_KEY` environment variable. 2. The user follows the documented setup command. 3. The shell expands `$STRIPE_KEY`, placing the plaintext credential in the new process's argument vector. 4. A local user or monitoring component capable of observing process arguments or related telemetry captures the key while the command runs or from retained logs. 5. The captured key is used against Stripe APIs within the permissions assigned to that key. Exploitation requires access to process metadata, command telemetry, logs, or another location where the expanded argument is retained. ### Impact Assessment Disclosure may permit unauthorized Stripe API operations up to the privileges of the exposed key. Depending on whether the key is restricted or unrestricted, potential effects include access to billing and customer records, modification of subscriptions or invoices, creation of refunds, and other payment-account operations. This finding does not itself provide system privilege escalation, and the exact impact depends on the key's Stripe permissions.
- Remediation
- ## Remediation Suggestions - Do not pass Stripe credentials through command-line flags. - Update the interface so `billing.sh` reads the credential directly from a protected environment variable without reproducing it in the argument vector, or accepts it through standard input with terminal echo disabled. - Prefer a dedicated secret manager or operating-system credential store for production deployments. - Use restricted Stripe API keys with only the permissions required by the billing workflow. - Ensure logs, diagnostics, errors, and telemetry redact credentials. - Avoid shell tracing such as `set -x` while handling secrets. - Rotate any key that may already have been exposed through this command pattern. - Add the referenced implementation to the package and subject its credential storage, logging, file permissions, and API authorization behavior to a separate security review.