T09 · Insecure Skill Coding Practices
- Location
scripts/bankai_write.mjs:31- Finding
Arbitrary Environment Credential Exfiltration to a User-Controlled Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
scripts/bankai_write.mjs, lines 31–34 and 96–110
Vulnerability Type: Unrestricted credential and sensitive-data transmission
Risk Level: HighVulnerable Code
js else if (t === '--key-env') a.keyEnv = argv[++i]; else if (t === '--base-url') a.baseUrl = argv[++i];js const apiKey = process.env[args.keyEnv]; if (!apiKey) fail(`未找到 API Key：环境变量 ${args.keyEnv} 为空（或用 --mock 离线测试）`); const base = args.baseUrl || DEFAULT_BASE; const body = JSON.stringify({ model: args.model, messages, temperature: TEMP, max_tokens: MAX_TOKENS, stream: false }); resp = await fetch(base, { method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` }, body, signal: ctrl.signal, });Technical Analysis
The CLI permits callers to control both the name of the environment variable used as an API credential and the destination URL receiving that credential.
No allowlist restricts
--key-envto a dedicated BankAI credential, and no validation restricts--base-urlto trusted HTTPS endpoints. Consequently, any environment variable accessible to the Node.js process can be selected and transmitted in the HTTPAuthorizationheader to an arbitrary server.The request body also contains
messages, which incorporates user-provided banking-document data. Therefore, exploitation can disclose both an unrelated environment secret and confidential document content. Because the URL scheme is not validated, selecting an unencrypted HTTP endpoint can also expose these values to network interception.Attack Path
- The victim runs the Skill in an environment containing a sensitive variable, such as a cloud credential, deployment token, or unrelated API key.
- An attacker influences the command invocation through malicious instructions, compromised automation, or direct local access.
- The attacker selects the sensitive variable and an attacker-contro ...[truncated 1454 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove unrestricted environment-variable selection. Read only a dedicated variable such as
DEEPSEEK_API_KEY, or enforce a strict allowlist of Skill-specific credential names. - Do not automatically forward the DeepSeek credential to custom endpoints. Require a distinct, endpoint-specific credential variable for private or third-party endpoints.
- Validate custom URLs with the standard
URLparser and permit only approved protocols and destinations. - Require HTTPS for remote endpoints. If local development requires HTTP, limit it to explicitly approved loopback addresses and require an opt-in insecure-development flag.
- Introduce a trusted-host allowlist or require explicit interactive confirmation before transmitting credentials or document content to a non-default host.
- Reject URLs containing embedded credentials, unexpected ports, redirects to untrusted hosts, or ambiguous host representations.
- Disable automatic redirect following or validate every redirect destination so credentials cannot be forwarded to a different origin.
- Warn users clearly when public-cloud endpoints will receive potentially sensitive banking data, and default sensitive workflows to approved private endpoints.
- Apply data minimization and redaction before constructing the request body. Avoid transmitting fields not required for generation.
- Add automated security tests verifying that unrelated environment variables cannot be selected, HTTP endpoints are rejected, unapproved hosts are blocked, and authorization headers are not forwarded across origins.
- Remove unrestricted environment-variable selection. Read only a dedicated variable such as