T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/generate_blessing.py:5
- Finding
- API credential may be transmitted to the wrong or untrusted provider## Vulnerability Details **File Location**: `scripts/generate_blessing.py:5-6` and `scripts/generate_blessing.py:54-57` **Vulnerability Type**: Provider/credential mismatch and insufficient endpoint validation **Risk Level**: High ### Vulnerable Code ```python API_KEY = os.environ.get("OPENAI_API_KEY") or os.environ.get("DEEPSEEK_API_KEY", "") API_BASE = os.environ.get("OPENAI_API_BASE", "https://api.deepseek.com") ``` ```python payload = json.dumps({"model": MODEL, "messages": [ {"role": "system", "content": "你是一位擅长写祝福语的文字高手，能够根据不同节日、不同对象、不同风格生成有温度、有个性的祝福语。请用中文输出。"}, {"role": "user", "content": prompt} ], "temperature": 0.9}).encode() req = urllib.request.Request(f"{API_BASE}/chat/completions", data=payload, headers={"Content-Type": "application/json", "Authorization": f"Bearer {API_KEY}"}) ``` ### Technical Analysis Credential selection is independent of API endpoint selection. The script gives `OPENAI_API_KEY` precedence, while the default endpoint is DeepSeek. Therefore, when `OPENAI_API_KEY` is defined and `OPENAI_API_BASE` is not, the script sends the OpenAI credential to `https://api.deepseek.com`. In addition, `OPENAI_API_BASE` is accepted without validation. A modified process environment can redirect requests to an arbitrary endpoint, including a server controlled by an attacker or an unencrypted HTTP endpoint. The selected API key is always placed in the `Authorization` header sent to that endpoint. ### Attack Path 1. The execution environment contains a valid `OPENAI_API_KEY`. 2. `OPENAI_API_BASE` is either unset or changed to an unintended endpoint. 3. The user runs the documented blessing-generation command. 4. The script selects `OPENAI_API_KEY`. 5. It sends that key in the Bearer authorization header to the default DeepSeek endpoint or the configured untrusted endpoint. 6. The recipient can capture and attempt to use the exposed credential. ### Impact Assessment A discl ...[truncated 337 chars]
- Remediation
- ## Remediation Suggestions - Couple each credential to its corresponding provider and endpoint. - Use `DEEPSEEK_API_KEY` when the endpoint is DeepSeek, and use `OPENAI_API_KEY` only for an explicitly selected OpenAI endpoint. - Require explicit provider selection rather than inferring it from unrelated environment variables. - Validate the endpoint with a strict allowlist of trusted HTTPS origins. - Reject plaintext HTTP, embedded credentials, unexpected ports, redirects to untrusted origins, and unknown hosts. - If custom endpoints are required, place them behind an explicit opt-in flag and clearly warn that the credential will be sent to that host. - Use provider-specific environment variables such as `DEEPSEEK_API_BASE` and `OPENAI_API_BASE`. - Avoid forwarding authorization headers across redirects to a different origin. A safer configuration pattern would select the provider first, then load only that provider's endpoint and credential. The program should terminate with an error if the selected provider, endpoint, and credential do not match.