T09 · Insecure Skill Coding Practices
- Location
SKILL.md:31- Finding
Arbitrary Backend Override Can Disclose the Agent Bearer Token
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 31–43 and 381–382
Vulnerability Type: Bearer-token disclosure through an untrusted backend URL
Risk Level: HighVulnerable Code
text - `BASE_URL`: use `https://api.bankofuniverse.org/` unless the user explicitly gives a different backend - `AGENT_KEY`: bearer token in `ak_...` format Treat the agent key as secret. Do not print, commit, or store it in repo files.sh curl -sS "$BASE_URL/..." \ -H "Authorization: Bearer $AGENT_KEY" \ -H "Accept: application/json"text Before running requests: - Verify `BASE_URL` is correct - Verify the token looks like `ak_...`Technical Analysis
The Skill permits a user to replace the default API origin with an arbitrary
BASE_URL, while its common request pattern sendsAGENT_KEYto that origin in the HTTPAuthorizationheader. It does not define an approved-host allowlist, require HTTPS for a custom backend, prohibit embedded credentials, or specify a robust destination-validation procedure.Merely instructing the Agent to verify that the URL is “correct” does not establish an enforceable trust boundary. Likewise, checking that a token starts with
ak_validates only its superficial format and does not protect it from disclosure. The instruction not to print or store the key also does not prevent transmission to an attacker-controlled network endpoint.Although sending the bearer key to the official API is necessary for the declared wallet functionality, sending that same key to an unrestricted custom backend exceeds minimum privilege. If support for alternative deployments is required, they should use independently scoped credentials rather than the production key associated with the official service.
Attack Path
- An attacker or untrusted prompt tells the Agent to use an attacker-controlled URL as
BASE_URL. - The Agent accepts the override because `S ...[truncated 1372 chars]
- An attacker or untrusted prompt tells the Agent to use an attacker-controlled URL as
- Remediation
View remediation
Remediation Suggestions
-
Pin authenticated requests to the exact approved origin,
https://api.bankofuniverse.org, and reject arbitrary overrides when using the productionAGENT_KEY. -
If custom backends are operationally necessary:
- Require explicit, informed user confirmation before transmitting credentials.
- Maintain an allowlist of approved HTTPS origins.
- Use a separate credential scoped specifically to each custom backend.
- Never reuse the official production bearer token with another origin.
-
Parse and validate the destination URL rather than relying on string-prefix checks:
- Require the
httpsscheme. - Compare the normalized hostname and port against an allowlist.
- Reject user information embedded in URLs.
- Reject unexpected ports and ambiguous or malformed hostnames.
- Require the
-
Prevent redirects from moving an authenticated request to another origin. For example, do not enable redirect following for requests carrying authorization headers, and consider using:
sh curl --proto '=https' --proto-redir '=https' --max-redirs 0 \ -sS "https://api.bankofuniverse.org/..." \ -H "Authorization: Bearer $AGENT_KEY" \ -H "Accept: application/json" -
Apply server-side least privilege by issuing separate, narrowly scoped credentials for read access, trading, transfers, withdrawals, and paid upstream calls.
-
Require additional confirmation or authorization for irreversible operations such as withdrawals, transfers, leverage changes, and broad order cancellation.
-
Add explicit Skill instructions that the bearer token must never be sent to merchant URLs, arbitrary hosts, diagnostic endpoints, or user-provided backends.
-
Rotate any key suspected of having been transmitted to an untrusted origin and review account activity for unauthorized operations.
-