T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_auth_token.py:27- Finding
Reversible API Credentials Exposed Through Command-Line Arguments and Standard Output
- Content
View full analysis
") sys.exit(1) app_key = sys.argv[1] app_secret = sys.argv[2] token = generate_access_token(app_key, app_secret) print(f"Access Token: {token}") print(f"\nUse in Authorization header as: Basic {token}") ``` The documented invocation is: ```bash python scripts/generate_auth_token.py YOUR_APP_KEY YOUR_APP_SECRET ``` ### Technical Analysis The helper accepts the application key and secret as command-line arguments, combines them as `app_key:app_secret`, Base64-encodes the resulting value, and prints it to standard output. Base64 is reversible encoding rather than encryption. Anyone who obtains the printed Basic token can recover both values directly. In an Agent environment, standard output may be returned to the caller or retained in execution logs. Command-line arguments may also be exposed through shell history, process listings, terminal logs, or process telemetry. This disclosure is unnecessary for the Skill's declared functionality. The primary API client already constructs the required Authorization header internally, so users and Agents do not need to receive or handle the reusable token. The Base64 operation in `scripts/tomoviee_text2sfx_client.py` is different: that client uses the encoded value only to construct the provider-required Basic Authorization header and sends it over HTTPS to the fixed, declared `openapi.wondershare.cc` endpoint. That network behavior is necessa ...[truncated 1265 chars]- Remediation
View remediation