T09 · Insecure Skill Coding Practices
Warning
- Location
- references/trello-api.md:3
- Finding
- Trello API credentials exposed in URL query strings<![CDATA[ ## Vulnerability Details **File Location**: `references/trello-api.md:3-35` **Vulnerability Type**: Sensitive credential exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```markdown ## Authentication All requests require `key` and `token` query parameters. - Credentials file: look for `trello-credentials.json` in workspace secrets. - Format: `{"apiKey": "...", "apiToken": "..."}` ## Key Endpoints ### Boards ``` GET /1/members/me/boards?key={key}&token={token}&fields=name,url,dateLastActivity ``` ### Lists on a Board ``` GET /1/boards/{boardId}/lists?key={key}&token={token}&fields=name,pos ``` ### Cards on a Board (with actions for cycle time) ``` GET /1/boards/{boardId}/cards?key={key}&token={token}&fields=name,idList,labels,dateLastActivity,due,dueComplete&actions=updateCard:idList&actions_limit=1000 ``` - `actions` filter `updateCard:idList` returns list-transition history per card. - Each action has `data.listBefore.name`, `data.listAfter.name`, `date`. ### Card Details (single) ``` GET /1/cards/{cardId}?key={key}&token={token}&actions=updateCard:idList&actions_limit=50 ``` ### Card Actions (full history) ``` GET /1/cards/{cardId}/actions?key={key}&token={token}&filter=all&limit=50 ``` ``` ### Technical Analysis The Skill instructs the Agent to read a Trello API key and token from a workspace secret file and interpolate both credentials into every Trello request URL. Authentication against Trello is necessary for the declared agile-board analysis, but repeatedly placing a reusable token in URL query strings creates avoidable credential exposure. URLs can be captured by HTTP client diagnostics, proxy and gateway access logs, application performance monitoring, exception reports, command histories, and other telemetry. Although HTTPS protects the request from passive network interception in transit, it does not prevent the full URL from being recorded at either endpoint or by trusted intermediary infrastru ...[truncated 1851 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer a supported authorization header or an official authenticated Trello client that keeps credentials out of URLs, where the API and client capabilities permit it. 2. If Trello requires query-parameter authentication for these endpoints: - Construct requests programmatically rather than displaying or executing literal credential-bearing URLs. - Disable verbose HTTP logging for authenticated requests. - Add mandatory redaction for query parameters named `key` and `token` in logs, traces, exceptions, and telemetry. - Ensure generated reports never contain request URLs or credential values. 3. Request explicit user authorization before reading credential files and restrict secret discovery to the documented filenames and intended secrets directory. 4. Use a dedicated, least-privileged Trello token with only the permissions required for read-only metric analysis. 5. Prefer short-lived or readily revocable credentials and document immediate token rotation after suspected log exposure. 6. Ensure scheduled jobs reference a protected secret store at runtime rather than embedding credentials in task definitions, command lines, environment dumps, or generated files. 7. Add a security warning to the API reference stating that credential-bearing URLs must never be printed, persisted, or included in error messages. ]]>