T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/hot_scanner.py:111- Finding
API Credential Exposure Through an Unrestricted Endpoint Override
- Content
View full analysis
OpenAI: api_key = os.environ.get("AISA_API_KEY") if not api_key: print("❌ Error: AISA_API_KEY environment variable is not set.", file=sys.stderr) print(" Set it with: export AISA_API_KEY=your_key_here", file=sys.stderr) sys.exit(1) base_url = os.environ.get("AISA_BASE_URL", "https://api.aisa.one/v1") return OpenAI(api_key=api_key, base_url=base_url) ``` ### Technical Analysis The Skill legitimately requires `AISA_API_KEY` to authenticate with the default AISA API. However, it also accepts the undocumented `AISA_BASE_URL` environment variable and passes its value directly to the OpenAI client without validating the URL scheme or destination host. The client subsequently authenticates requests to the selected endpoint using `AISA_API_KEY`. Consequently, a process, launcher, configuration file, or user capable of controlling the Skill's environment can redirect authenticated traffic to an attacker-controlled server. This behavior exceeds the minimum privileges needed for the declared functionality because the documented market scanner only needs to communicate with `https://api.aisa.one/v1`; unrestricted communication with arbitrary endpoints is unnecessary. ### Attack Path 1. An attacker gains the ability to influence the environment used to launch the Skill. 2. The attacker sets `AISA_BASE_URL` to an endpoint under their control. 3. A user invokes `scripts/hot_scanner.py` with a valid `AISA_API_KEY`. 4. `get_client()` constructs the client using the attacker-controlled base URL. 5. The scanner submits its authenticated chat-completion request to that server. 6. The attacker-controlled server records the authentication credential and request content. This path requires prior influence over the ...[truncated 668 chars]- Remediation
View remediation