T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/tron_api.mjs:62
- Finding
- TronGrid API Key Disclosed to Unrelated Third-Party Services<![CDATA[ ## Vulnerability Details **File Location**: `scripts/tron_api.mjs:62-66` **Vulnerability Type**: Credential disclosure caused by an overbroad authentication-header policy **Risk Level**: Critical ### Vulnerable Code ```js function headers(url = "") { const h = { "Content-Type": "application/json", Accept: "application/json" }; // Only add TRON-PRO-API-KEY for TronGrid requests, not for TronScan if (TRONGRID_API_KEY && !url.includes("tronscanapi.com")) { h["TRON-PRO-API-KEY"] = TRONGRID_API_KEY; } return h; } ``` The affected helper is used for destinations configured elsewhere in the same file: ```js const SUNIO_ROUTER_API = { mainnet: "https://rot.endjgfsv.link", nile: "https://tnrouter.endjgfsv.link", }; const COINGECKO_API = "https://api.coingecko.com/api/v3"; ``` ### Technical Analysis The comment states that the credential should only be added to TronGrid requests, but the condition implements a negative check that excludes only URLs containing `tronscanapi.com`. Every other host receives the `TRON-PRO-API-KEY` header. As a result, requests to CoinGecko and the Sun.io router domains receive a credential intended for TronGrid. This violates least privilege and unnecessarily expands the set of parties trusted with the secret. The behavior is not required for the declared read-only market and swap-quotation functionality. Those external APIs can be queried without receiving a TronGrid credential. ### Attack Path 1. A user exports a valid `TRONGRID_API_KEY`. 2. The user or Agent invokes a CoinGecko-backed command such as `trending-tokens`, `token-rankings`, or `token-price --contract TRX`, or invokes `swap-quote`. 3. `httpGet()` calls `headers(url)`. 4. Because the destination is not `tronscanapi.com`, the helper adds the TronGrid key. 5. The key is transmitted to `api.coingecko.com`, `rot.endjgfsv.link`, or `tnrouter.endjgfsv.link`. 6. The receiving service, its infrastructure operators, or a compromised endpoint can r ...[truncated 544 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace negative substring filtering with an exact origin allowlist: ```js const TRONGRID_ORIGINS = new Set([ "https://api.trongrid.io", "https://api.shasta.trongrid.io", "https://nile.trongrid.io", ]); function headers(url = "") { const h = { "Content-Type": "application/json", Accept: "application/json", }; const origin = new URL(url).origin; if (TRONGRID_API_KEY && TRONGRID_ORIGINS.has(origin)) { h["TRON-PRO-API-KEY"] = TRONGRID_API_KEY; } return h; } ``` 2. Use separate request helpers or authentication policies for TronGrid, TronScan, CoinGecko, and the swap router. 3. Add automated tests asserting that credentials are absent from all non-TronGrid requests. 4. Document every service that receives user-supplied data and credentials. 5. Advise existing users to rotate TronGrid keys that may already have been exposed. ]]>