T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/main.ts:193
- Finding
- WeryAI API Key Can Be Forwarded to an Arbitrary Result URL<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.ts:193-199` **Duplicate Location**: `scripts/vendor/shared-image-generation/scripts/main.ts:199-205` **Vulnerability Type**: Credential disclosure through unrestricted cross-origin authorization forwarding **Risk Level**: High ### Vulnerable Code ```ts for (const useAuth of [false, true] as const) { try { const init: RequestInit = { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) }; if (useAuth) init.headers = { Authorization: `Bearer ${getApiKey()}` }; res = await fetch(url, init); threw = null; if (res.ok) break; lastErr = `HTTP ${res.status}`; if (!useAuth && (res.status === 401 || res.status === 403)) continue; break; } catch (e) { threw = e; res = null; lastErr = e instanceof Error ? e.message : String(e); if (!useAuth) continue; break; } } ``` ### Technical Analysis The image downloader accepts URLs from `detail.images`, which is populated from the remote gateway response. It first accesses each URL without authentication and then retries with the WeryAI bearer credential if the request returns HTTP 401 or 403. No exact-origin validation or hostname allowlist is applied before adding the `Authorization` header. Consequently, the API key can be sent to a domain unrelated to WeryAI. HTTPS alone does not prevent this disclosure because an attacker controlling the destination legitimately receives all request headers. This credential forwarding exceeds the minimum privileges needed to download generated images. Result downloads should ordinarily be performed without gateway credentials, or authenticated only after verifying that the destination is an explicitly trusted WeryAI origin. ### Attack Path 1. An attacker compromises, manipulates, or otherwise influences a gateway task response. 2. The response places an attacker-controlled URL in `detail.images`. 3. The Skill requests that URL without authentication. 4. The attack ...[truncated 799 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Never send the WeryAI API key to URLs returned in image results. 2. Remove the authenticated fallback and download result URLs without an `Authorization` header. 3. If authenticated downloads are unavoidable, parse the URL and enforce: - The `https:` protocol. - An exact allowlist of documented WeryAI/CDN hostnames. - Explicit port restrictions. - Rejection of embedded credentials and nonstandard URL forms. 4. Disable automatic redirects or validate every redirect destination before forwarding authentication. 5. Use origin-bound credentials or short-lived download tokens instead of the main gateway API key. 6. Apply the same correction to the vendored duplicate. 7. Add tests confirming that no authorization header is sent to untrusted hosts, including after 401/403 responses and redirects. 8. Rotate any API key used with the affected implementation if untrusted result URLs may have been processed. ]]>