T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:8
- Finding
- Bearer Credential and Sensitive Editing Data Can Be Sent to a Configurable Host<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:8-21, 36-41, 61-69` **Vulnerability Type**: Unvalidated security-sensitive endpoint configuration **Risk Level**: Medium ### Vulnerable Code ```yaml requires: env: - ADSCENE_API_URL - ADSCENE_API_KEY bins: - curl - jq primaryEnv: ADSCENE_API_KEY envVars: - name: ADSCENE_API_URL required: true description: Base URL for the Levea API, for example https://api.livecore.ai. Do not use the studio URL or the /api/v1/misc/editor route. - name: ADSCENE_API_KEY required: true description: OpenClaw API key generated from the Studio app at https://studio.livecore.ai/. ``` ```bash curl -sS -X POST "$ADSCENE_API_URL/api/v1/misc/openclaw/v1/execute" \ -H "Authorization: Bearer $ADSCENE_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "tool": "autonomous_edit", "params": { "prompt": "Make this a TikTok-ready viral clip: vertical reframe, add bold captions, remove silences, and apply motion tracking to the speaker." }, "project_id": "my-project" }' ``` The same configurable-host pattern is repeated in the job polling and result-fetching examples at `SKILL.md:285-294`. Equivalent documentation using `LEVEA_API_URL` and `LEVEA_API_KEY` appears in `README.md:234-264` and `README.md:344-352`. ### Technical Analysis The Skill must transmit an API credential and user editing data to a remote service to provide its declared video-editing functionality. That network access is therefore functionally necessary. However, the destination receiving the bearer credential is taken directly from the configurable `ADSCENE_API_URL` environment variable. The documentation recommends `https://api.livecore.ai`, but the demonstrated commands do not enforce the HTTPS scheme, exact hostname, or expected port before attaching the `Authorization` header. If an attacker or compromised configuration source can alter `ADSCENE_API_URL`, subsequent requests will ...[truncated 1878 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Default to and enforce the exact production origin: ```text https://api.livecore.ai ``` 2. Before attaching the bearer token, parse and validate the endpoint: - Require HTTPS. - Require the exact approved hostname. - Reject embedded credentials, fragments, unexpected ports, and hostname suffix tricks. - Resolve the final URL using a proper URL parser rather than string or prefix checks. 3. If custom or self-hosted endpoints are genuinely supported, require an explicit opt-in and maintain a separate administrator-controlled allowlist. 4. Configure the HTTP client to reject redirects for authenticated requests, or independently validate every redirect destination before forwarding credentials. 5. Avoid placing credentials in command-line arguments. The current header expansion occurs in the shell process rather than directly in the command text, but a dedicated client with protected secret handling would reduce accidental exposure. 6. Document exactly what data is transmitted remotely and require user consent before uploading media, images, scene data, or working memory. 7. Scope API keys to the minimum required account, project, and operation permissions. Support key rotation and revocation after suspected exposure. 8. Add automated tests confirming that HTTP endpoints, malformed URLs, look-alike domains, and unapproved hosts are rejected before authorization headers are created. ]]>