T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/core/generate.py:14
- Finding
- Stability API Credential Disclosure Through an Unrestricted Custom API Host<![CDATA[ ## Vulnerability Details **File Location**: `scripts/core/generate.py:14-15, 68, 103-116, 188, 218-231` **Vulnerability Type**: Credential disclosure to an attacker-controlled network endpoint **Risk Level**: High ### Vulnerable Code ```python API_HOST = os.getenv('API_HOST', 'https://api.stability.ai') API_KEY = os.getenv("STABILITY_API_KEY") ``` ```python url = f"{API_HOST}/v1/generation/{model}/text-to-image" headers = { "Accept": "application/json", "Content-Type": "application/json", "Authorization": f"Bearer {API_KEY}", } response = requests.post(url, headers=headers, json=body, timeout=120) ``` The same behavior is present in the V2 request: ```python url = f"{API_HOST}/v2beta/stable-image/generate/core" headers = { "Authorization": f"Bearer {API_KEY}", } response = requests.post(url, headers=headers, files=files, data=data, timeout=120) ``` ### Technical Analysis The destination host is loaded directly from the `API_HOST` environment variable without validating its scheme or hostname. The script then unconditionally places `STABILITY_API_KEY` in the HTTP `Authorization` header. Although sending the key to Stability AI is necessary for the declared image-generation functionality, allowing an unrestricted destination exceeds the minimum privilege required. A modified `.env` file, inherited environment variable, or unsafe deployment configuration can redirect the request to any server. The implementation also permits a plain HTTP URL, which would expose the key and prompt data to network interception. Both API implementations are affected. In addition to the bearer credential, the requests transmit the user-provided prompt, negative prompt, generation parameters, and other request metadata. ### Attack Path 1. An attacker modifies the Skill's `.env` file or otherwise controls the `API_HOST` environment variable. 2. The attacker sets `API_HOST` to an endpoint under their control, such as `https://attacker.example`. 3 ...[truncated 999 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict the production endpoint to the expected Stability AI origin: ```python API_HOST = "https://api.stability.ai" ``` 2. If custom endpoints are a required feature, parse the URL and enforce: - HTTPS only. - An explicit hostname allowlist. - No embedded URL credentials. - A permitted port list. - No ambiguous or malformed hostnames. 3. Do not send `STABILITY_API_KEY` to custom providers. Use a separate, provider-specific credential for each explicitly configured host. 4. Require explicit user confirmation before sending credentials or prompt data to a non-default endpoint. 5. Consider disabling redirects for authenticated requests with `allow_redirects=False`, or validate every resulting destination before permitting an authorization credential to be forwarded. 6. Document that prompts and credentials are transmitted to the configured endpoint. 7. Rotate the Stability AI API key if the Skill has previously been run with an untrusted or plain HTTP `API_HOST`. ]]>