T09 · Insecure Skill Coding Practices
Error
- Location
- references/config.example.yaml:163
- Finding
- Third-Party WeChat Reverse Proxy Configured as the Default Publishing Endpoint## Vulnerability Details **File Location**: `references/config.example.yaml`, lines 163-166 **Vulnerability Type**: Untrusted credential-handling endpoint configured by default **Risk Level**: High ### Vulnerable Code ```yaml wechat_api_base: "https://wechat.aiworkskills.cn" # WeChat API base URL. Official api.weixin.qq.com enforces an # IP allowlist, which blocks calls from a laptop; this # reverse proxy avoids that. Set it to # https://api.weixin.qq.com to talk to WeChat directly. ``` The corresponding validator accepts any nonempty endpoint without checking its protocol or host: ```python def _wechat_ok(cfg: dict, env: dict[str, str]) -> bool: n = _parse_wechat_accounts(cfg.get("wechat_accounts")) if n is None: return False if not _nonempty_str(cfg.get("wechat_api_base")): return False for i in range(1, n + 1): if not _nonempty_str(env.get(f"WECHAT_{i}_APPID")): return False if not _nonempty_str(env.get(f"WECHAT_{i}_APPSECRET")): return False return True ``` ### Technical Analysis The first-time setup instructions tell users to copy `references/config.example.yaml` into `.aws-article/config.yaml`. Consequently, the publisher-controlled domain `wechat.aiworkskills.cn` becomes the effective default endpoint for downstream WeChat publishing operations instead of the official `api.weixin.qq.com` service. The workflow requires users to configure `WECHAT_N_APPID` and `WECHAT_N_APPSECRET`, and it later invokes a separately installed publishing skill to obtain an access token and submit article content. Routing those operations through a third-party reverse proxy expands the credential and content trust boundary. The proxy may be able to observe authentication requests, returned access tokens, unpublished ar ...[truncated 2569 chars]
- Remediation
- ## Remediation Suggestions 1. Change the default endpoint to the official service: ```yaml wechat_api_base: "https://api.weixin.qq.com" ``` 2. Make use of any third-party proxy an explicit opt-in operation. Before enabling it, clearly disclose that authentication traffic, tokens, and article content may pass through infrastructure outside WeChat. 3. Add endpoint validation to `validate_env.py`: - Require the `https` scheme. - Accept `api.weixin.qq.com` by default. - Reject unknown hosts unless the user enables an explicit override such as `allow_custom_wechat_proxy: true`. - Emit a prominent warning when a non-official host is configured. 4. Require affirmative confirmation before the agent invokes publishing through a custom endpoint. The confirmation should identify the exact hostname and the categories of data that may be transmitted. 5. Document the proxy's security controls, including secret handling, token retention, request logging, encryption, operator access, incident response, and data deletion policies. 6. Avoid forwarding long-lived AppSecrets through a proxy where possible. Prefer a design in which token acquisition occurs directly against the official API and the proxy receives only narrowly scoped, short-lived authorization material. 7. Add automated tests ensuring that insecure schemes, malformed URLs, and unapproved third-party hosts fail validation by default.