T09 · Insecure Skill Coding Practices
Error
- Location
scripts/watchlist.py:55- Finding
API Credential Can Be Forwarded to an Arbitrary Configured Endpoint
- Content
View full analysis
OpenAI: api_key = os.environ.get("AISA_API_KEY") if not api_key: print("❌ Error: AISA_API_KEY environment variable is not set.", file=sys.stderr) sys.exit(1) base_url = os.environ.get("AISA_BASE_URL", "https://api.aisa.one/v1") return OpenAI(api_key=api_key, base_url=base_url) ``` ### Technical Analysis The Skill retrieves the sensitive `AISA_API_KEY` credential and supplies it to an OpenAI-compatible client whose destination is controlled by the `AISA_BASE_URL` environment variable. The code does not enforce HTTPS, validate the destination hostname, or restrict the override to trusted AISA domains. When `check` is run, the client sends an authenticated request to the configured endpoint. Consequently, anyone capable of influencing the Skill's environment can redirect the API request to an attacker-controlled server. That server can capture the API authorization credential as well as the request body containing the user's watchlist ticker symbols. Live network access and authentication to the documented AISA service are necessary for the declared live-price functionality. Allowing the same credential to be forwarded to an unrestricted destination exceeds the minimum privilege needed for that functionality. ### Attack Path 1. An attacker influences the execution environment, deployment configuration, shell profile, wrapper script, or task configuration. 2. The attacker sets `AISA_BASE_URL` to an endpoint under their control, such as `https://attacker.example/v1`. 3. The user invokes `python3 scripts/watchlist.py check`. 4. `get_client()` constructs a client using the legitimate `AISA_API_KEY` but the attacker-controlled base URL. 5. The client sends an authenticated chat- ...[truncated 791 chars]- Remediation
View remediation