T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:16
- Finding
- Configurable API Endpoint Can Expose Bearer Credentials and User Content## Vulnerability Details **File Location**: `SKILL.md`, lines 16–21, 36–41, and 61–69 **Vulnerability Type**: Unrestricted credential destination **Risk Level**: Medium ### Vulnerable Code ```yaml envVars: - name: ADSCENE_API_URL required: true description: Base URL for the Levea API, for example https://api.livecore.ai. Do not use the studio URL or the /api/v1/misc/editor route. - name: ADSCENE_API_KEY required: true description: OpenClaw API key generated from the Studio app at https://studio.livecore.ai/. ``` ```markdown `POST {ADSCENE_API_URL}/api/v1/misc/openclaw/v1/execute` Auth: `Authorization: Bearer {ADSCENE_API_KEY}` Create an account and generate the OpenClaw API key in Studio: `https://studio.livecore.ai/`. Use `https://api.livecore.ai` for `ADSCENE_API_URL`; Studio is only for signup, login, and key management. ``` ```bash curl -sS -X POST "$ADSCENE_API_URL/api/v1/misc/openclaw/v1/execute" \ -H "Authorization: Bearer $ADSCENE_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "tool": "autonomous_edit", "params": { "prompt": "Make this a TikTok-ready viral clip: vertical reframe, add bold captions, remove silences, and apply motion tracking to the speaker." }, "project_id": "my-project" }' ``` ### Technical Analysis The Skill obtains both the API base URL and bearer credential from environment variables and sends the credential to the configured URL without enforcing that the destination is the official Levea API origin. Although the documentation recommends `https://api.livecore.ai`, this recommendation is not a technical security control. If `ADSCENE_API_URL` is changed through misconfiguration, a compromised environment, or malicious installation guidance, the documented command sends the `ADSCENE_API_KEY` directly to the substituted server. The request can also contain prompts, project iden ...[truncated 1823 chars]
- Remediation
- ## Remediation Suggestions 1. Use a fixed production endpoint such as `https://api.livecore.ai` unless custom deployments are an explicit functional requirement. 2. If endpoint configurability is required, parse the URL and enforce an allowlist of approved HTTPS origins before constructing any authenticated request. 3. Reject plaintext HTTP, embedded credentials, unexpected ports, malformed hosts, and lookalike domains. 4. Disable redirects for authenticated API requests where possible. Otherwise, reject every cross-origin redirect and strip authorization headers before any redirected request. 5. Separate endpoint configuration from credential release so the bearer token is attached only after origin validation succeeds. 6. Document exactly which user data is transmitted, including prompts, media references, screenshots, scene state, asset descriptors, and working memory. 7. Apply narrowly scoped, revocable API keys and provide key rotation and usage-monitoring controls. 8. Avoid logging authorization headers, complete request bodies, or sensitive working-memory objects.