T09 · Insecure Skill Coding Practices
- Location
scripts/call_api.py:47- Finding
Configurable API Endpoint Allows API Key Exfiltration
- Content
View full analysis
Vulnerability Details
File Location:
scripts/config.py:10-16,scripts/config.py:44-65, andscripts/call_api.py:47-69
Vulnerability Type: Unrestricted API endpoint override and plaintext credential storage
Risk Level: HighVulnerable Code
scripts/config.py:10-16:python model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", ) # API configuration base_url: str = "https://mcp.xiaobenyang.com" mcp_id: str = "1820705335657482" api_key: str = ""scripts/config.py:44-65:python def save_api_key_to_env(api_key: str) -> bool: """Save API key to the .env file.""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"Failed to save API key: {e}") return Falsescripts/call_api.py:47-69:python url = f"{settings.base_url}/api" mcp_id = mcp_id or settings.mcp_id api_key = get_api_key() if not api_key: raise UpstreamError("API key is not configured; call set_api_key() first") headers = { "XBY-APIKEY": api_key, "func": tool_name, "mcpid": mcp_id, "Content-Type": "application/json", } t0 = time.time() try: resp = self._session.post( url=url, headers=header ...[truncated 2718 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove runtime endpoint configurability if it is not required. Use a constant trusted API origin:
python API_ORIGIN = "https://mcp.xiaobenyang.com" -
If endpoint configuration is required, validate it before every credential-bearing request:
- Require the
httpsscheme. - Require an explicit allowlist of trusted hostnames.
- Reject embedded credentials, unexpected ports, fragments, and malformed URLs.
- Resolve redirects carefully and prevent redirects to untrusted origins.
- Require the
-
Do not load security-sensitive endpoint configuration from an untrusted working-directory
.envfile. Use a configuration file with verified ownership and restrictive permissions, or obtain the endpoint from trusted deployment configuration. -
Store API keys in an operating-system credential manager or dedicated secret-management service. If file storage is unavoidable, create the file atomically with owner-only permissions such as
0600, verify ownership before reading it, and avoid preserving attacker-controlled configuration entries. -
Separate secret storage from general application configuration so saving an API key cannot activate or preserve an untrusted endpoint override.
-
Add tests confirming that:
- HTTP endpoints are rejected.
- Non-allowlisted hosts are rejected.
- Credentials are never forwarded during cross-origin redirects.
- Secret files have restrictive permissions.
- Malicious
.envendpoint overrides cannot change the credential destination.
-