T09 · Insecure Skill Coding Practices
Error
- Location
- vwu-chat.sh:6
- Finding
- Attacker-Controlled API Endpoint Can Receive Credentials and Prompts<![CDATA[ ## Vulnerability Details **File Location**: `vwu-chat.sh`, lines 6 and 29–36 **Vulnerability Type**: Unvalidated destination configuration and credential disclosure **Risk Level**: High ### Vulnerable Code ```zsh VWU_BASE_URL="${VWU_BASE_URL:-https://vwu.ai}" ``` ```zsh response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $VWU_API_KEY" \ -d "{ \"model\": \"$MODEL\", \"messages\": [{\"role\": \"user\", \"content\": \"$PROMPT\"}], \"stream\": false }") ``` ### Technical Analysis The script permits the `VWU_BASE_URL` environment variable to determine the complete destination of the API request. It does not validate the URL scheme, hostname, port, or presence of embedded credentials before attaching the `VWU_API_KEY` bearer token. Environment variables can cross a trust boundary when the script is launched by another process, automation framework, shell profile, or attacker-influenced wrapper. If `VWU_BASE_URL` is changed to an attacker-controlled endpoint, `curl` sends both the authorization credential and the user's prompt to that endpoint. The variable can also specify a cleartext HTTP URL, allowing network observers to intercept this information. The endpoint override is not documented in `SKILL.md`, making it less likely that users will recognize it as a security-sensitive configuration option. ### Attack Path 1. An attacker gains influence over the environment used to invoke the Skill, such as through a wrapper script, compromised automation configuration, or manipulated shell environment. 2. The attacker sets `VWU_BASE_URL` to an endpoint under their control, potentially using cleartext HTTP. 3. The user or Agent invokes `vwu-chat.sh` with a valid `VWU_API_KEY` and a prompt. 4. The script constructs the request URL from the attacker-controlled value. 5. `curl` transmits `Authorization: Bearer $VWU_API_KEY` and the prompt to the attack ...[truncated 849 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `VWU_BASE_URL` configurability if alternate endpoints are not a required feature. 2. If endpoint configuration is necessary, parse and validate the URL before making a request. 3. Require the `https` scheme and reject cleartext HTTP. 4. Enforce an explicit allowlist of trusted hostnames, such as `vwu.ai`. 5. Reject unexpected ports, embedded URL credentials, fragments, and malformed hostnames. 6. Keep TLS certificate verification enabled and do not introduce insecure `curl` options such as `-k`. 7. Document the endpoint override as a security-sensitive setting. 8. Consider using a separate credential for development or alternate endpoints rather than sending the production key to configurable destinations. Example restrictive validation: ```zsh VWU_BASE_URL="${VWU_BASE_URL:-https://vwu.ai}" if [ "$VWU_BASE_URL" != "https://vwu.ai" ]; then echo "Error: unsupported API endpoint" >&2 exit 1 fi ``` If multiple endpoints are legitimate, compare parsed schemes and hostnames against a fixed allowlist rather than relying on string prefixes. ]]>