T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:25- Finding
Trello access token exposed through request URLs and process arguments
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 25–80
Vulnerability Type: Credentials exposed in URLs and command-line arguments
Risk Level: MediumThe following documented commands place
TRELLO_API_KEYand the full-accessTRELLO_TOKENdirectly in URL query strings:bash curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id}' curl -s "https://api.trello.com/1/boards/{boardId}/lists?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id}' curl -s "https://api.trello.com/1/lists/{listId}/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, id, desc}' curl -s -X POST "https://api.trello.com/1/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "idList={listId}" \ -d "name=Card Title" \ -d "desc=Card description" curl -s -X PUT "https://api.trello.com/1/cards/{cardId}?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "idList={newListId}" curl -s -X POST "https://api.trello.com/1/cards/{cardId}/actions/comments?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "text=Your comment here" curl -s -X PUT "https://api.trello.com/1/cards/{cardId}?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" \ -d "closed=true" curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN&fields=name,id" | jq curl -s "https://api.trello.com/1/members/me/boards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | select(.name | contains("Work"))' curl -s "https://api.trello.com/1/boards/{boardId}/cards?key=$TRELLO_API_KEY&token=$TRELLO_TOKEN" | jq '.[] | {name, list: .idList}'Technical Analysis
The shell expands both environment variables before starting
curl, causing the resulting URL—including the Trello token—to become part of the process arguments. Depending on operating-system process visibility and monitoring configuration, command arg ...[truncated 2074 chars]- Remediation
View remediation
Remediation Suggestions
- Use Trello's supported
Authorizationheader rather than putting credentials in URL query parameters. - Avoid placing a sensitive header value directly in command-line arguments, because
curl -H "Authorization: ..."may still expose the token through process inspection. Supply sensitive curl configuration through protected standard input or a permission-restricted configuration file. - For example, construct a curl configuration through standard input while disabling shell tracing around credential handling:
bash set +x printf '%s\n' \ 'silent' \ 'header = "Authorization: OAuth oauth_consumer_key=\"'"$TRELLO_API_KEY"'\", oauth_token=\"'"$TRELLO_TOKEN"'\""' \ 'url = "https://api.trello.com/1/members/me/boards"' | curl --config - | jq '.[] | {name, id}' - Ensure temporary or persistent credential files, if used, are owned by the account running the skill, have mode
0600, and are securely deleted when no longer needed. - Configure command tracing, endpoint telemetry, reverse proxies, and application logs to redact Trello tokens and authorization data.
- Apply the least privileges available when generating Trello tokens and use a dedicated integration identity rather than a personal account where practical.
- Revoke and regenerate any token suspected of having appeared in process captures, diagnostic bundles, terminal recordings, or URL logs.
- Use Trello's supported