T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/query.py:58- Finding
Bearer JWT Exposed Through Command-Line Arguments
- Content
View full analysis
[日期 YYYY-MM-DD]") sys.exit(1) jwt = sys.argv[1] date = sys.argv[2] if len(sys.argv) > 2 else None ``` ```python # scripts/activities.py:41-43 if __name__ == '__main__': jwt = sys.argv[1] if len(sys.argv) > 1 else None if not jwt: ``` ```markdown ```bash python3 scripts/query.py [日期 YYYY-MM-DD] ``` ``` ```markdown ```bash # 查询今日数据 python3 scripts/query.py "$GARMIN_JWT" # 查询指定日期 python3 scripts/query.py "$GARMIN_JWT" 2026-03-24 # 查询最近活动 python3 scripts/activities.py "$GARMIN_JWT" ``` ``` ### Technical Analysis Both executable scripts obtain the Garmin bearer JWT from `sys.argv`. Even when an environment variable is expanded using `"$GARMIN_JWT"`, the resulting secret becomes part of the child process's argument vector. Depending on the operating system and local security configuration, process arguments may be exposed through process-monitoring commands, diagnostic tools, audit records, crash reports, process telemetry, or automation logs. Commands containing a literal token may additionally remain in shell history. The JWT is an account access credential rather than a non-sensitive identifier. The scripts use it in an `Authorization: Bearer` header to request Garmin profile, activity, and health information. ### Attack Path 1. A victim follows the documented command and passes the Garmin JWT as the first argument. 2. While the process is running, a local user or monitoring component reads its command-line arguments through process inspection or telemetry. 3. Alternatively, ...[truncated 600 chars]- Remediation
View remediation