T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/lib/env.py:248
- Finding
- Repository-Controlled Xiaohongshu Endpoint Enables SSRF and Research Topic Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/env.py:65-76, 92-102, 248-251`; `scripts/lib/pipeline.py:904-911`; `scripts/lib/xiaohongshu_api.py:67-101` **Vulnerability Type**: Server-Side Request Forgery through an unvalidated, repository-controlled service endpoint **Risk Level**: Medium ### Vulnerable Code `scripts/lib/env.py:65-76` discovers configuration files controlled by the current project or one of its parent directories: ```python def _find_project_env() -> Path | None: """Find per-project .env by walking up from cwd. Searches for .claude/last30days.env in each parent directory, stopping at the user's home directory or filesystem root. """ cwd = Path.cwd() for parent in [cwd, *cwd.parents]: candidate = parent / '.claude' / 'last30days.env' if candidate.exists(): return candidate # Stop at filesystem root or home if parent == Path.home() or parent == parent.parent: break return None ``` `scripts/lib/env.py:92-102` gives this project configuration precedence over the default configuration: ```python # Load from per-project config (overrides global) project_env_path = _find_project_env() project_env = load_env_file(project_env_path) if project_env_path else {} # Merge: project overrides global merged_env = {**file_env, **project_env} # Build config: process.env > project .env > global .env config = { 'AISA_API_KEY': os.environ.get('AISA_API_KEY') or merged_env.get('AISA_API_KEY'), 'AISA_BASE_URL': os.environ.get('AISA_BASE_URL') or merged_env.get('AISA_BASE_URL', 'https://api.aisa.one'), ``` `scripts/lib/env.py:248-251` accepts the configured URL without validating its scheme, hostname, or resolved address: ```python def get_xiaohongshu_api_base(config: dict[str, Any]) -> str: """Get Xiaohongshu HTTP API base URL. Defaults to host.docker.internal so OpenClaw Docker can reach host service. """ return (config.get('XIAO ...[truncated 4319 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not allow repository-controlled configuration files to define network service destinations. Restrict custom endpoints to trusted user-level configuration or an explicit command-line option. 2. Use a fixed, trusted Xiaohongshu service endpoint where possible. 3. If custom endpoints are necessary, parse and validate them before use: - Require HTTPS in production. - Permit HTTP only for an explicit development mode and only for approved loopback hosts. - Reject embedded credentials, fragments, ambiguous hostnames, and unsupported ports. - Resolve the hostname and reject loopback, link-local, private, multicast, unspecified, and cloud-metadata address ranges unless specifically authorized. - Revalidate redirect destinations and DNS resolution for every connection. 4. Maintain an exact hostname allowlist rather than relying on suffix matching. 5. Require explicit user confirmation before contacting a non-default endpoint and display the exact origin that will receive the query. 6. Disable automatic redirects or ensure authorization and request bodies are never forwarded to a different origin. 7. Add tests covering malicious values such as: - `http://127.0.0.1` - `http://169.254.169.254` - IPv6 loopback and link-local addresses - Private-network hostnames - Redirects from an allowed hostname to a prohibited address - DNS rebinding scenarios ]]>