T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pager-triage.sh:77- Finding
PagerDuty API Token Exposed Through Process Arguments
- Content
View full analysis
/dev/null) || { ``` ### Technical Analysis The PagerDuty API token is expanded into the `curl` argument array and passed as an HTTP header using `-H`. Although the token originates from an environment variable, its expanded value becomes part of the `curl` process argument vector. On systems where process arguments are visible to other local users, diagnostic agents, container administrators, or monitoring software, the complete authorization header may be recovered while the request is running. This contradicts the assertion in `SECURITY.md` that credentials are never passed through command-line arguments. The same issue applies to `PAGERDUTY_EMAIL` during write requests, although disclosure of the API token presents the greater security risk. ### Attack Path 1. A legitimate user or agent invokes a PagerDuty command such as `incidents` or `detail`. 2. The script expands `PAGERDUTY_API_KEY` into the `curl` command-line argument containing the authorization header. 3. During the request, an attacker with sufficient same-host process visibility inspects the `curl` process through facilities such as `/proc`, process monitoring, container administration, or telemetry collection. 4. The attacker extracts the complete ...[truncated 1057 chars]- Remediation
View remediation