T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_common.sh:57- Finding
Bearer Token Disclosure Through an Unrestricted API Base URL
- Content
View full analysis
"$err_file") || curl_status=$? ``` ### Technical Analysis Authenticated requests add `MYREELS_ACCESS_TOKEN` to the `Authorization` header without first verifying that the resolved destination is the official MyReels HTTPS origin. `MYREELS_BASE_URL` may be supplied through the environment or sourced configuration, and no scheme or hostname allowlist is enforced. Consequently, the token can be transmitted to an attacker-controlled host or over plaintext HTTP. Generation request bodies may also contain private prompts, source-media URLs, or other user-provided generation parameters and would be disclosed to the same destination. Allowing a configurable endpoint can be useful for development, but forwarding production credentials to an unrestricted destination exceeds the minimum privileges necessary for the declared functionality. ### Attack Path 1. An attacker influences the process environment or the MyReels configuration file. 2. The attacker sets `MYREELS_BASE_URL` to a host under their control, such as `http://attacker.example`. 3. The user or agent invokes `myreels-generate.sh`, `myreels-task-get.sh`, ...[truncated 710 chars]- Remediation
View remediation