T09 · Insecure Skill Coding Practices
- Location
scripts/generate_blessing.py:5- Finding
API credential may be transmitted to the wrong or untrusted provider
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate_blessing.py:5-6andscripts/generate_blessing.py:54-57
Vulnerability Type: Provider/credential mismatch and insufficient endpoint validation
Risk Level: HighVulnerable Code
python API_KEY = os.environ.get("OPENAI_API_KEY") or os.environ.get("DEEPSEEK_API_KEY", "") API_BASE = os.environ.get("OPENAI_API_BASE", "https://api.deepseek.com")python payload = json.dumps({"model": MODEL, "messages": [ {"role": "system", "content": "你是一位擅长写祝福语的文字高手，能够根据不同节日、不同对象、不同风格生成有温度、有个性的祝福语。请用中文输出。"}, {"role": "user", "content": prompt} ], "temperature": 0.9}).encode() req = urllib.request.Request(f"{API_BASE}/chat/completions", data=payload, headers={"Content-Type": "application/json", "Authorization": f"Bearer {API_KEY}"})Technical Analysis
Credential selection is independent of API endpoint selection. The script gives
OPENAI_API_KEYprecedence, while the default endpoint is DeepSeek. Therefore, whenOPENAI_API_KEYis defined andOPENAI_API_BASEis not, the script sends the OpenAI credential tohttps://api.deepseek.com.In addition,
OPENAI_API_BASEis accepted without validation. A modified process environment can redirect requests to an arbitrary endpoint, including a server controlled by an attacker or an unencrypted HTTP endpoint. The selected API key is always placed in theAuthorizationheader sent to that endpoint.Attack Path
- The execution environment contains a valid
OPENAI_API_KEY. OPENAI_API_BASEis either unset or changed to an unintended endpoint.- The user runs the documented blessing-generation command.
- The script selects
OPENAI_API_KEY. - It sends that key in the Bearer authorization header to the default DeepSeek endpoint or the configured untrusted endpoint.
- The recipient can capture and attempt to use the exposed credential.
Impact Assessment
A discl ...[truncated 337 chars]
- The execution environment contains a valid
- Remediation
View remediation
Remediation Suggestions
- Couple each credential to its corresponding provider and endpoint.
- Use
DEEPSEEK_API_KEYwhen the endpoint is DeepSeek, and useOPENAI_API_KEYonly for an explicitly selected OpenAI endpoint. - Require explicit provider selection rather than inferring it from unrelated environment variables.
- Validate the endpoint with a strict allowlist of trusted HTTPS origins.
- Reject plaintext HTTP, embedded credentials, unexpected ports, redirects to untrusted origins, and unknown hosts.
- If custom endpoints are required, place them behind an explicit opt-in flag and clearly warn that the credential will be sent to that host.
- Use provider-specific environment variables such as
DEEPSEEK_API_BASEandOPENAI_API_BASE. - Avoid forwarding authorization headers across redirects to a different origin.
A safer configuration pattern would select the provider first, then load only that provider's endpoint and credential. The program should terminate with an error if the selected provider, endpoint, and credential do not match.