T09 · Insecure Skill Coding Practices
- Location
src/free_search/quota_real.py:103- Finding
Tavily API Key Exposure Through URL Query-String Fallback
- Content
View full analysis
Vulnerability Details
File Location:
src/free_search/quota_real.py:103-112
Vulnerability Type: API credential exposure in URL query parameters
Risk Level: MediumVulnerable Code
python def _get_tavily_quota(api_key: str) -> RealQuotaResult: url = "https://api.tavily.com/usage" headers = {"Authorization": f"Bearer {api_key}"} params = {"api_key": api_key} # Try Authorization header first, then fallback to query param. try: resp = requests.get(url, headers=headers, timeout=10) if resp.status_code in (401, 403): resp = requests.get(url, params=params, timeout=10)Technical Analysis
The quota-checking implementation initially sends the Tavily credential in an
Authorizationheader, but after an HTTP 401 or 403 response it retries with the API key in the URL query string.Although HTTPS encrypts the request in transit, query strings are commonly recorded in provider access logs, reverse-proxy logs, monitoring systems, exception telemetry, browser or HTTP debugging tools, and network observability products. Authorization headers are more commonly subject to explicit redaction than URL parameters.
The request is sent to Tavily's declared HTTPS endpoint, so this is not evidence of intentional credential exfiltration. Nevertheless, the fallback exceeds the safer authentication mechanism already implemented and unnecessarily increases credential exposure.
Attack Path
- An operator configures
TAVILY_API_KEY. - The operator invokes a real quota check using the
--realCLI option or the Python API. - Tavily returns HTTP 401 or 403 to the header-authenticated request.
- The Skill retries using
?api_key=<secret>. - A provider, proxy, monitoring agent, or diagnostic system records the complete request URL.
- A party with access to those records extracts the key and reuses it against Tavily.
Impact Assessment
Successful exploitation does not grant local operating- ...[truncated 321 chars]
- An operator configures
- Remediation
View remediation
Remediation Suggestions
- Remove the query-string fallback and use only the documented authorization-header mechanism.
- If Tavily requires a different fallback mechanism, prefer a request body over a URL parameter.
- Treat HTTP 401 and 403 responses as authentication failures rather than automatically retransmitting the credential through a less secure channel.
- Ensure HTTP clients, proxies, and telemetry systems redact sensitive query parameters.
- Use narrowly scoped, revocable API keys and rotate any key suspected of appearing in logs.
- Add a regression test that inspects prepared requests and verifies that the API key never appears in the URL.