T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:41- Finding
API Key Exposed Through Command-Line Arguments
- Content
View full analysis
``` ### Technical Analysis The documented initialization command instructs users to provide an approved QName AI API key directly as a command-line argument. When the placeholder is replaced with a real credential, the key may be exposed through: - Shell history files. - Process argument inspection while the command is running. - Terminal session logs. - Command auditing or diagnostic telemetry. - Accidental copying of the complete command into support records. Although the document later recommends the `QNAME_API_KEY` environment variable for ephemeral sessions and warns users to treat the key as secret, the primary initialization example still promotes an insecure credential-handling pattern. ### Attack Path 1. A user replaces `` with a valid QName AI API key and executes the documented command. 2. The shell records the complete command in its history, or the argument is captured by process inspection, session recording, audit logging, or diagnostic software. 3. A local user, compromised process, or party with access to collected logs retrieves the exposed key. 4. The attacker submits requests to QName AI using the stolen credential. 5. The attacker consumes the API operations and quotas authorized for that key, such as WHOIS, traffic lookup, or keyword research where enabled. This attack requires access to the affected host, command history, process metadata, terminal logs, or related telemetry; the documentation does not itself transmit the key externally. ### Impact Assessment A recovered credential grants access only within the API types, account permissions, and quotas assigned to that key. Potential consequences include unauthorized API use, quota exhaustion ...[truncated 213 chars]- Remediation
View remediation