T09 · Insecure Skill Coding Practices
Error
- Location
- vwu-chat.sh:7
- Finding
- Unvalidated API Endpoint Override Can Expose Credentials and Prompts<![CDATA[ ## Vulnerability Details **File Location**: `vwu-chat.sh`, lines 7 and 31–39 **Vulnerability Type**: Unvalidated sensitive-data destination **Risk Level**: High ### Vulnerable Code ```zsh VWU_BASE_URL="${VWU_BASE_URL:-https://vwu.ai}" ``` ```zsh response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $VWU_API_KEY" \ -d "{ \"model\": \"$MODEL\", \"messages\": [{\"role\": \"user\", \"content\": \"$PROMPT\"}], \"stream\": false }") ``` ### Technical Analysis The script obtains `VWU_BASE_URL` directly from the process environment and uses it as the destination for a request containing both the bearer API key and the user's prompt. It does not validate the URL scheme or destination host. Consequently, a party capable of controlling the environment in which the script is launched can redirect the request to an arbitrary server. An `http://` URL can additionally cause the credential and prompt to be transmitted without transport encryption. The URL is quoted, so this issue does not establish shell command injection. The vulnerability is the unauthorized disclosure of sensitive request data to an untrusted network destination. ### Attack Path 1. An attacker gains control over the launch environment, wrapper script, service configuration, CI job, or shell profile used to invoke the skill. 2. The attacker sets `VWU_BASE_URL` to an endpoint under their control, such as `https://attacker.example`. 3. The user invokes `vwu-chat.sh` with a legitimate API key and prompt. 4. The script sends an HTTP request to `https://attacker.example/v1/chat/completions`. 5. The attacker receives the `Authorization: Bearer ...` header, selected model, and complete user prompt. 6. The stolen key may then be used against the legitimate service within the permissions and quota assigned to that key. ### Impact Assessment An attacker can obtain the configured VWU API key ...[truncated 460 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Pin the endpoint to the intended service if endpoint customization is unnecessary: ```zsh readonly VWU_BASE_URL="https://vwu.ai" ``` - If overrides are operationally required, parse and validate the URL before sending credentials: - Require the `https` scheme. - Permit only an explicit allowlist of trusted hostnames. - Reject embedded credentials, unexpected ports, fragments, and malformed URLs. - Do not rely on substring or suffix matching for hostname validation. - Restrict `curl` to HTTPS and fail safely: ```zsh curl --fail-with-body --silent --show-error \ --proto '=https' \ --connect-timeout 10 \ --max-time 120 \ ... ``` - Run the script in a controlled environment and prevent untrusted wrappers, shell profiles, CI variables, or service definitions from setting security-sensitive configuration. - Rotate the API key if the script may already have been run with an untrusted endpoint. - Avoid displaying even partial API-key material in error output where logs may be shared. ]]>