T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:25
- Finding
- Trello Credentials Exposed in URL Query Strings<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 25–80 **Vulnerability Type**: Credentials included in URL query strings **Risk Level**: Medium ### Vulnerable Code ```bash # List boards curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id}' # List lists in a board curl -s "https://api.trello.com/1/boards/{boardId}/lists?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id}' # List cards in a list curl -s "https://api.trello.com/1/lists/{listId}/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id, desc}' # Create a card curl -s -X POST "https://api.trello.com/1/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "idList={listId}" \ -d "name=Card Title" \ -d "desc=Card description" # Move a card to another list curl -s -X PUT "https://api.trello.com/1/cards/{cardId}?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "idList={newListId}" # Add a comment to a card curl -s -X POST "https://api.trello.com/1/cards/{cardId}/actions/comments?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "text=Your comment here" # Archive a card curl -s -X PUT "https://api.trello.com/1/cards/{cardId}?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "closed=true" # Get all boards curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN&fields=name,id" | jq # Find a specific board by name curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | select(.name | contains("Work"))' # Get all cards on a board curl -s "https://api.trello.com/1/boards/{boardId}/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, list: .idList}' ``` ### Technical Analysis Every documented API request embeds `TRELLO_API_KEY` and `TRELLO_TOKEN` directly in the request URL. Although HTTPS protects the URL while it is transmitted to Trello, query-string credentials can still be exposed through loc ...[truncated 2220 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Avoid placing secrets in URLs. Use Trello's supported `Authorization` header mechanism instead of `key` and `token` query parameters where supported. For example: ```bash curl -s \ -H "Authorization: OAuth oauth_consumer_key=\"$TRELLO_API_KEY\", oauth_token=\"$TRELLO_TOKEN\"" \ "https://api.trello.com/1/members/me/boards" | jq '.[] | {name, id}' ``` 2. Keep credentials exclusively in protected environment variables or a dedicated secret manager. Do not place literal keys or tokens in scripts, configuration committed to source control, command examples, or CI configuration. 3. Configure CI systems, session recorders, proxies, gateways, and observability tools to redact Trello credentials and `Authorization` headers. Disable verbose shell tracing such as `set -x` while handling secrets. 4. Grant each Trello token only the scopes and account permissions necessary for the intended operations. Prefer separate tokens for automation rather than reusing broadly privileged personal tokens. 5. Rotate tokens regularly and revoke them immediately when exposure is suspected. Document a credential-rotation and incident-response procedure. 6. Add an explicit warning that URL query parameters may be retained by process inspection and operational logging, rather than only stating that the credentials should be kept secret. ]]>