T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/verify_tts_media_route.sh:5- Finding
Bearer Token Exposure Through Command-Line Arguments and Unencrypted HTTP
- Content
View full analysis
" >&2 echo "Example: $0 http://127.0.0.1:15443 abc123 9f2c... /tmp/tts_headers.txt" >&2 exit 2 fi BASE_URL="$1" TOKEN="$2" TTS_ID="$3" HEADERS_OUT="$4" URL="${BASE_URL%/}/media/tts/${TTS_ID}.mp3" curl -sS -D "$HEADERS_OUT" \ -H "Authorization: Bearer ${TOKEN}" \ ``` The associated documentation also recommends sending the token to a generic plaintext HTTP endpoint in `SKILL.md`, lines 75–77: ```bash curl -i -H "Authorization: Bearer " \ "http://:/media/tts/.mp3" \ --range 0-127 ``` ### Technical Analysis The verification script requires the bearer token to be supplied as a positional command-line argument. Depending on the operating system and shell environment, command-line arguments can be exposed through process inspection facilities such as `ps` or `/proc`, terminal logging, shell history, audit logs, and command wrappers. The script accepts an unrestricted `base_url`, including plaintext HTTP URLs and remote hosts. The bearer token is placed directly in the `Authorization` header without checking the URL scheme or destination. When HTTP is used across a non-loopback network, the token can be intercepted by an attacker able to observe or modify network traffic. If an untrusted URL is supplied, the destination server directly receives the credential. ### Attack Path 1. An operator invokes the script with a valid gateway bearer token as its second positional argument. 2. A local attacker monitors process arguments, process-auditing output, terminal records, or other command logging while the script is running. 3. Alternatively, the operator uses an HTTP endpoint on a non-loopback interface, as permit ...[truncated 769 chars]- Remediation
View remediation