T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts.py:27
- Finding
- Configurable API Endpoint Can Expose Credentials and Search Queries<![CDATA[ ## Vulnerability Details **File Location**: `scripts.py`, lines 27–38 and 70–75 **Vulnerability Type**: Unrestricted destination for sensitive network transmission **Risk Level**: Medium ### Vulnerable Code ```python url = f"{api_base}/api/v1/proxy/tavily/search" headers = { "Authorization": f"Bearer {api_key}", "client": client, "environment": environment, "Content-Type": "application/json", "User-Agent": "openclaw-tavily-web-search", } response = requests.post(url, json=request_body, headers=headers, timeout=30) ``` ```python _cfg = _load_env_from_config() api_key = _getcfg("TURING_API_KEY", _cfg) client = _getcfg("TURING_CLIENT", _cfg) environment = _getcfg("TURING_ENVIRONMENT", _cfg) api_base = (_getcfg("TURING_API_BASE", _cfg) or "https://live-turing.cn.llm.tcljd.com").rstrip("/") for name, val in [("TURING_API_KEY", api_key), ("TURING_CLIENT", client), ("TURING_ENVIRONMENT", environment)]: ``` ### Technical Analysis The script obtains `TURING_API_BASE` from `~/.openclaw/openclaw.json` and uses it directly to construct the destination URL. It does not validate the URL scheme, hostname, port, embedded user information, or whether the destination is an approved Turing proxy. Every request transmits the following information to that destination: - The Turing bearer token in the `Authorization` header - The client identifier - The environment name - The user's search query and optional domain filters Network transmission is necessary for the declared web-search functionality, and the default endpoint uses HTTPS. However, allowing an unrestricted endpoint is not necessary to contact the documented service and weakens least-privilege protections. A value using `http://` exposes credentials and query data over plaintext transport. An attacker-controlled HTTPS host can receive the same information directly. Exploitation requires the attacker to influence the Skill configuration, such as through existing ...[truncated 1584 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse `TURING_API_BASE` with a standard URL parser and require the `https` scheme. 2. Allowlist the documented proxy hostname, `live-turing.cn.llm.tcljd.com`, when custom proxy destinations are not operationally required. 3. If custom endpoints are required, maintain an explicit administrator-controlled trusted-host allowlist rather than accepting arbitrary URLs. 4. Reject URLs containing embedded credentials, fragments, unexpected ports, malformed hostnames, or non-HTTPS schemes. 5. Avoid forwarding authorization and identifying headers across redirects. Prefer disabling redirects or validating the scheme and destination of every redirect before resending sensitive headers. 6. Store the API token with restrictive file permissions and use a dedicated, narrowly scoped credential that can access only the required Tavily proxy operation. 7. Document that a custom API endpoint receives the bearer token, client identifier, environment name, and all submitted query data. 8. Add automated tests confirming that HTTP URLs, unapproved hosts, malformed URLs, and unsafe redirect destinations are rejected before any request is sent. ]]>