T09 · Insecure Skill Coding Practices
- Location
scripts/looper-api.sh:7- Finding
Administrator API Key Disclosure Through an Unvalidated API Base URL
- Content
View full analysis
Vulnerability Details
File Location:
scripts/looper-api.sh, lines 7–45
Vulnerability Type: Unvalidated destination for authenticated API requests
Risk Level: HighVulnerable Code
bash API_URL="${LOOPER_API_URL:-https://api.looper.bot}" KEY="${LOOPER_ADMIN_KEY:-}" if [ -z "$KEY" ]; then echo "Error: LOOPER_ADMIN_KEY not set. Sign up at POST $API_URL/api/signup" >&2 exit 1 fi case "${1:-help}" in loops) curl -s "$API_URL/api/loops" -H "Authorization: Bearer $KEY" ;; loop) # Usage: looper-api.sh loop <id> curl -s "$API_URL/api/loops/$2" -H "Authorization: Bearer $KEY" ;; runs) # Usage: looper-api.sh runs <loop-id> curl -s "$API_URL/api/loops/$2/runs" -H "Authorization: Bearer $KEY" ;; trigger) # Usage: looper-api.sh trigger <loop-id> curl -s -X POST "$API_URL/api/loops/$2/run" -H "Authorization: Bearer $KEY" ;; toggle) # Usage: looper-api.sh toggle <loop-id> true|false curl -s -X PATCH "$API_URL/api/loops/$2" \ -H "Authorization: Bearer $KEY" \ -H "Content-Type: application/json" \ -d "{\"enabled\": $3}" ;; github) # Show GitHub connection status curl -s "$API_URL/api/github/status" -H "Authorization: Bearer $KEY" ;; tenant) # Show current tenant info curl -s "$API_URL/api/tenant" -H "Authorization: Bearer $KEY" ;;Technical Analysis
The script accepts
LOOPER_API_URLdirectly from the process environment and uses it as the destination for every API request. It then attaches the sensitiveLOOPER_ADMIN_KEYto those requests through theAuthorization: Bearerheader.No validation restricts the URL to the legitimate
https://api.looper.botorigin. There are no checks for the HTTPS scheme, expected hostname, embedded credentials, or an approved development-host allowlist. Consequently, any party capable of controlling the script's environment can redirect authenticated requests to an attacker-controlled server ...[truncated 1769 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove arbitrary production endpoint overrides and use a fixed trusted origin:
bash readonly API_URL="https://api.looper.bot" -
If endpoint configurability is required for testing, validate it before reading or transmitting the key. Enforce an explicit allowlist of complete origins:
bash API_URL="${LOOPER_API_URL:-https://api.looper.bot}" case "$API_URL" in "https://api.looper.bot") ;; *) echo "Error: untrusted LOOPER_API_URL" >&2 exit 1 ;; esac -
Maintain separate test credentials for non-production endpoints. Never send a production administrator key to development, staging, localhost, or user-defined hosts.
-
Configure
curldefensively:- Require HTTPS for authenticated production requests.
- Use
--fail-with-body --show-error. - Avoid following redirects, or explicitly prevent forwarding credentials across origins.
- Reject URLs containing embedded credentials or unexpected ports.
-
Minimize credential privileges. Prefer narrowly scoped API keys over an administrator key when commands only require loop-management permissions.
-
Rotate any
LOOPER_ADMIN_KEYthat may have been used whileLOOPER_API_URLpointed to an untrusted endpoint, then review loop, key, tenant, and integration activity for unauthorized changes.
-