T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:25
- Finding
- Trello access token exposed through request URLs and process arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 25–80 **Vulnerability Type**: Credentials exposed in URLs and command-line arguments **Risk Level**: Medium The following documented commands place `TRELLO_API_KEY` and the full-access `TRELLO_TOKEN` directly in URL query strings: ```bash curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id}' curl -s "https://api.trello.com/1/boards/{boardId}/lists?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id}' curl -s "https://api.trello.com/1/lists/{listId}/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id, desc}' curl -s -X POST "https://api.trello.com/1/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "idList={listId}" \ -d "name=Card Title" \ -d "desc=Card description" curl -s -X PUT "https://api.trello.com/1/cards/{cardId}?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "idList={newListId}" curl -s -X POST "https://api.trello.com/1/cards/{cardId}/actions/comments?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "text=Your comment here" curl -s -X PUT "https://api.trello.com/1/cards/{cardId}?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "closed=true" curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN&fields=name,id" | jq curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | select(.name | contains("Work"))' curl -s "https://api.trello.com/1/boards/{boardId}/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, list: .idList}' ``` ### Technical Analysis The shell expands both environment variables before starting `curl`, causing the resulting URL—including the Trello token—to become part of the process arguments. Depending on operating-system process visibility and monitoring configuration, command arg ...[truncated 2074 chars]
- Remediation
- ## Remediation Suggestions 1. Use Trello's supported `Authorization` header rather than putting credentials in URL query parameters. 2. Avoid placing a sensitive header value directly in command-line arguments, because `curl -H "Authorization: ..."` may still expose the token through process inspection. Supply sensitive curl configuration through protected standard input or a permission-restricted configuration file. 3. For example, construct a curl configuration through standard input while disabling shell tracing around credential handling: ```bash set +x printf '%s\n' \ 'silent' \ 'header = "Authorization: OAuth oauth_consumer_key=\"'"$TRELLO_API_KEY"'\", oauth_token=\"'"$TRELLO_TOKEN"'\""' \ 'url = "https://api.trello.com/1/members/me/boards"' | curl --config - | jq '.[] | {name, id}' ``` 4. Ensure temporary or persistent credential files, if used, are owned by the account running the skill, have mode `0600`, and are securely deleted when no longer needed. 5. Configure command tracing, endpoint telemetry, reverse proxies, and application logs to redact Trello tokens and authorization data. 6. Apply the least privileges available when generating Trello tokens and use a dedicated integration identity rather than a personal account where practical. 7. Revoke and regenerate any token suspected of having appeared in process captures, diagnostic bundles, terminal recordings, or URL logs.