T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/rumor_scanner.py:139- Finding
API Credential Disclosure Through Unrestricted Endpoint Override
- Content
View full analysis
OpenAI: api_key = os.environ.get("AISA_API_KEY") if not api_key: print("❌ Error: AISA_API_KEY environment variable is not set.", file=sys.stderr) print(" Set it with: export AISA_API_KEY=your_key_here", file=sys.stderr) sys.exit(1) base_url = os.environ.get("AISA_BASE_URL", "https://api.aisa.one/v1") return OpenAI(api_key=api_key, base_url=base_url) ``` The resulting client makes an authenticated request here: ```python response = client.chat.completions.create( model=model, messages=[ {"role": "system", "content": SYSTEM_PROMPT}, {"role": "user", "content": prompt}, ], temperature=0.2, ) ``` ### Technical Analysis The `AISA_BASE_URL` environment variable is accepted without validation and passed directly to the OpenAI-compatible client. The same client is initialized with the production `AISA_API_KEY`. Consequently, changing `AISA_BASE_URL` can cause the authenticated API request to be sent to an arbitrary server. Depending on the OpenAI client's authentication behavior, the AIsa key is transmitted in the authorization headers of that request. Supporting a configurable API endpoint can be legitimate, but forwarding a production credential to any environment-selected destination exceeds the minimum privileges needed for the declared functionality. The Skill only needs to communicate with the documented AIsa service at `https://api.aisa.one/v1`. The transmitted message content consists of fixed market-scanning prompts rather than local files or arbitrary user secrets. The principal sensitive asset exposed by this weakness is the AIsa API credential. ### Attack Path 1. An attacker gains the ability to influen ...[truncated 1408 chars]- Remediation
View remediation