T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:28
- Finding
- Trello API Credentials Exposed in Command-Line URLs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 28-83 **Vulnerability Type**: Credentials exposed through process arguments and URL logging **Risk Level**: Medium The documented commands consistently place `TRELLO_API_KEY` and `TRELLO_TOKEN` in URL query parameters. ```bash curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id}' curl -s "https://api.trello.com/1/boards/{boardId}/lists?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id}' curl -s "https://api.trello.com/1/lists/{listId}/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id, desc}' curl -s -X POST "https://api.trello.com/1/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "idList={listId}" \ -d "name=Card Title" \ -d "desc=Card description" curl -s -X PUT "https://api.trello.com/1/cards/{cardId}?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "idList={newListId}" curl -s -X POST "https://api.trello.com/1/cards/{cardId}/actions/comments?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "text=Your comment here" curl -s -X PUT "https://api.trello.com/1/cards/{cardId}?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "closed=true" curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN&fields=name,id" | jq curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | select(.name | contains("Work"))' curl -s "https://api.trello.com/1/boards/{boardId}/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, list: .idList}' ``` ### Technical Analysis The shell expands both environment variables before launching `curl`. Consequently, the complete URL—including the Trello API key and token—can be present in the process command-line arguments while the request is running. Depending on the operating-system configuration and execution environment, command lines may be observable by other local ...[truncated 2179 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer a Trello-supported authorization header or another authentication mechanism that keeps secrets out of the request URL and process arguments. 2. If Trello requires query-parameter authentication, supply the URL through a permission-restricted `curl` configuration file or equivalent mechanism rather than directly in the command line. Delete temporary configuration files immediately after use. 3. Ensure any temporary credential-bearing file is created with restrictive permissions, such as mode `0600`, and is stored in a private directory. 4. Disable shell tracing while handling credentials and avoid verbose request output, command echoing, debug logs, and telemetry that records complete URLs. 5. Configure proxies, monitoring systems, and API logging pipelines to redact `key` and `token` query parameters. 6. Use the least-privileged and shortest-lived Trello token available, and rotate any credential suspected of having appeared in process monitoring or logs. 7. Add an explicit warning that copying these examples directly can expose credentials through process listings and logging. 8. Avoid storing the credentials in shell history or source-controlled files, and restrict access to the environment in which the commands run. ]]>