T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/rumor_scanner.py:153
- Finding
- Unrestricted API Base URL Can Expose the AIsa API Key## Vulnerability Details **File Location**: `scripts/rumor_scanner.py`, lines 153–160 **Vulnerability Type**: Arbitrary authenticated API endpoint configuration **Risk Level**: Medium ```python def get_client() -> OpenAI: api_key = os.environ.get("AISA_API_KEY") if not api_key: print("❌ Error: AISA_API_KEY environment variable is not set.", file=sys.stderr) print(" Set it with: export AISA_API_KEY=your_key_here", file=sys.stderr) sys.exit(1) base_url = os.environ.get("AISA_BASE_URL", "https://api.aisa.one/v1") return OpenAI(api_key=api_key, base_url=base_url) ``` ### Technical Analysis The program reads `AISA_BASE_URL` from the environment and passes it directly to the OpenAI client without validating its scheme or hostname. The same client is configured with `AISA_API_KEY`, so authenticated requests may be directed to any endpoint selected through that environment variable. Network access to the default `https://api.aisa.one/v1` endpoint is declared in `SKILL.md` and is necessary for the Skill's stated market-scanning functionality. However, allowing an unrestricted endpoint override is not necessary for ordinary operation and weakens least-privilege protections around the credential. Exploitation requires an attacker to influence the process environment or its launch configuration. This is not a direct remote exploit by itself, and the code does not intentionally place the API key in prompt content or standard output. ### Attack Path 1. An attacker gains the ability to modify the environment, shell profile, service configuration, wrapper script, or task configuration used to launch the Skill. 2. The attacker sets `AISA_BASE_URL` to an attacker-controlled API-compatible endpoint. 3. The user invokes `scripts/rumor_scanner.py` with a valid `AISA_API_KEY`. 4. `get_client()` constructs an OpenAI client using the legitimate credential and the attacker-selected endpoint. 5 ...[truncated 742 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `AISA_BASE_URL` configurability if custom endpoints are not required. 2. If customization is necessary, parse the URL and require: - The `https` scheme. - An explicit allowlist of trusted hostnames. - No embedded username or password. - An expected path prefix and port. 3. Disable or strictly validate cross-origin redirects so authorization data cannot be forwarded to an untrusted host. 4. Do not reuse `AISA_API_KEY` for arbitrary custom endpoints. Require a separate endpoint-specific credential when a non-default service is selected. 5. Fail closed when URL parsing or validation fails and avoid printing credentials in errors or diagnostics. 6. Document the destination receiving the credential and the security implications of endpoint overrides. 7. Use narrowly scoped, revocable API keys with quota restrictions and rotate any key suspected of exposure.