T09 · Insecure Skill Coding Practices
Error
- Location
src/api.ts:9- Finding
Bearer Credential Disclosure Through an Unvalidated Custom API Endpoint
- Content
View full analysis
v !== undefined && v !== ''), ); const qs = params.toString(); if (qs) url += `?${qs}`; } const headers: Record = { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json', }; const opts: RequestInit = { method, headers }; if (body && ['POST', 'PUT', 'PATCH'].includes(method)) { opts.body = JSON.stringify(body); } const res = await fetch(url, opts); ``` ### Technical Analysis The API base URL is taken directly from the `STICKYHIVE_API_URL` environment variable without validating its scheme, hostname, port, or trust relationship. The same request path then unconditionally attaches `STICKYHIVE_API_KEY` as a bearer credential. Consequently, the security boundary for the API credential is determined entirely by an environment variable. If an attacker can influence that variable through a compromised launcher, CI configuration, shell profile, Agent environment, container configuration, or unsafe wrapper script, the attacker can redirect every authenticated request to a server under their control. The custom destination does not need to emulate the complete StickyHive API. It only needs to accept an HTTP request and record the `Authorization` header. The compiled executable in `dist/index.js` contains the same behavior, so invoking the distributed CLI exposes the same risk. ### Attack Path 1. The ...[truncated 1536 chars]- Remediation
View remediation