T09 · Insecure Skill Coding Practices
- Location
whisper-context.mjs:25- Finding
Arbitrary API Endpoint Can Receive the Bearer Token and Sensitive Conversation Data
- Content
View full analysis
Vulnerability Details
File Location:
whisper-context.mjs:4-6,whisper-context.mjs:25,whisper-context.mjs:242-262
Vulnerability Type: Unrestricted destination for authenticated sensitive-data requests
Risk Level: HighVulnerable Code
js const API_URL_DEFAULT = process.env.WHISPER_CONTEXT_API_URL || "https://context.usewhisper.dev"; const API_KEY = process.env.WHISPER_CONTEXT_API_KEY || ""; const PROJECT_DEFAULT = process.env.WHISPER_CONTEXT_PROJECT || "";js const apiUrl = flags.api_url || API_URL_DEFAULT;js async function post(apiUrl, path, body, options = {}) { return requestJson(`${apiUrl}${path}`, { method: "POST", headers: { "Content-Type": "application/json", Authorization: `Bearer ${API_KEY}`, }, body: JSON.stringify(body), }, options); } async function get(apiUrl, path, options = {}) { return requestJson(`${apiUrl}${path}`, { method: "GET", headers: { Authorization: `Bearer ${API_KEY}`, }, }, options); }Technical Analysis
The destination URL can be controlled through either
WHISPER_CONTEXT_API_URLor the--api_urlcommand-line flag. The value is used without validating its scheme, hostname, port, or trust relationship. Both thepostandgethelpers attachWHISPER_CONTEXT_API_KEYas a bearer token to requests sent to this destination.Consequently, an attacker who can influence the process environment, command arguments, or an agent-generated invocation can redirect authenticated traffic to an attacker-controlled server. POST operations may additionally disclose queries, complete user and assistant turns, persistent-memory content, user and session identifiers, metadata, cache-warming queries, or explicitly selected local file contents.
The remote communication itself is necessary for the Skill's declared context and memory functionality and is disclosed in `SKI ...[truncated 1786 chars]
- Remediation
View remediation
Remediation Suggestions
- Default to a fixed trusted origin such as
https://context.usewhisper.devand do not permit arbitrary per-command destination overrides. - Parse the configured endpoint with
new URL()and reject all schemes excepthttps:. - Enforce an explicit hostname and port allowlist. If self-hosted deployments must be supported, maintain a separately configured administrative allowlist.
- Require explicit user or administrator approval before sending credentials or private content to a non-default host.
- Use destination-scoped credentials for self-hosted endpoints rather than forwarding the production service token.
- Reject URLs containing embedded credentials, fragments, unexpected paths, or nonstandard ports unless expressly authorized.
- Add tests proving that HTTP URLs, malformed URLs, loopback addresses, link-local addresses, and unapproved domains are rejected.
- Clearly warn users before uploading complete conversations, memory data, identifiers, or file-derived content, and support redaction or data-minimization controls.
- Default to a fixed trusted origin such as