T09 · Insecure Skill Coding Practices
- Location
scripts/run.py:27- Finding
Configurable Unvalidated API Endpoint Can Expose Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/run.py:27-42andscripts/run.py:66-72
Vulnerability Type: Unvalidated destination URL and plaintext credential transmission
Risk Level: MediumVulnerable Code
python def build_base_url(): return os.getenv("AISKILLS_BASE_URL", DEFAULT_BASE_URL).rstrip("/") def build_headers(): api_key = os.getenv("AISKILLS_API_KEY", "").strip() tenant_id = os.getenv("AISKILLS_TENANT_ID", "default").strip() or "default" if not api_key: fail("AISKILLS_API_KEY is required") return { "Content-Type": "application/json", # Cloudflare blocks urllib's default Python user agent for this endpoint. "User-Agent": "ai-skills-runner/1.0 (+https://ai-skills.ai)", "Accept": "application/json", "X-API-Key": api_key, "X-Tenant-Id": tenant_id, }python def request_json(method, path, payload): body = None if payload is None else json.dumps(payload).encode("utf-8") req = urllib.request.Request( f"{build_base_url()}{path}", data=body, method=method, headers=build_headers(), )Technical Analysis
The application obtains its API destination directly from the
AISKILLS_BASE_URLenvironment variable without validating its scheme, hostname, port, or other URL components. It then attaches theAISKILLS_API_KEYandAISKILLS_TENANT_IDvalues to every request made to that destination.Consequently, a value such as
http://attacker.exampleis accepted. Requests sent to such a destination include the API key over plaintext HTTP, allowing network interception. An attacker-controlled HTTPS destination would also receive the credentials because the code does not restrict the destination to the intendedai-skills.aiservice.TLS certificate verification is enabled when HTTPS is used, but this does not prevent disclosure to an a ...[truncated 1607 chars]
- Remediation
View remediation
Remediation Suggestions
- Parse the base URL with
urllib.parse.urlsplit()and reject malformed values. - Require the
httpsscheme and explicitly reject plaintext HTTP. - Restrict the hostname to
ai-skills.aior a documented allowlist of trusted API hosts. - Reject embedded credentials, fragments, unexpected ports, and ambiguous hostname representations.
- Build request URLs using validated URL components rather than direct string concatenation.
- Only attach
X-API-KeyandX-Tenant-Idafter confirming that the final request destination is trusted. - Revalidate the destination after redirects, or disable cross-origin redirects, to prevent credentials from being forwarded to an untrusted host.
- If custom endpoints are operationally required, require explicit administrative configuration and maintain a trusted-host allowlist rather than accepting arbitrary environment values.
- Add automated tests confirming that HTTP URLs, unknown domains, embedded credentials, and unapproved ports are rejected.
- Parse the base URL with