T09 · Insecure Skill Coding Practices
- Location
scripts/index.js:18- Finding
Unvalidated Custom API Host Can Expose Credentials and User Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/index.js, lines 18–19, 49–58, and 97–117
Vulnerability Type: Unrestricted outbound destination with bearer credential forwarding
Risk Level: MediumVulnerable Code
javascript const KIMI_API_KEY = process.env.KIMI_API_KEY; const KIMI_API_HOST = process.env.KIMI_API_HOST || 'https://api.kimi.com/coding';javascript const resp = await fetch(`${KIMI_API_HOST}/v1/messages`, { method: 'POST', headers: { 'Authorization': `Bearer ${KIMI_API_KEY}`, 'Content-Type': 'application/json', 'anthropic-version': '2023-06-01', 'x-api-provider': 'kimi', }, body: JSON.stringify(body), });The image-analysis path performs the same request pattern:
javascript const resp = await fetch(`${KIMI_API_HOST}/v1/messages`, { method: 'POST', headers: { 'Authorization': `Bearer ${KIMI_API_KEY}`, 'Content-Type': 'application/json', 'anthropic-version': '2023-06-01', 'x-api-provider': 'kimi', }, body: JSON.stringify({ model, messages: [{ role: 'user', content: [ { type: 'image', source: { type: 'base64', media_type: mimeType, data: imageData } }, { type: 'text', text: prompt } ] }], temperature, max_tokens, }), });Technical Analysis
KIMI_API_HOSTis accepted directly from the process environment and used to construct the outbound request URL. The implementation does not enforce HTTPS, validate the hostname, restrict the port, or require explicit approval for a non-default destination.Every request includes the
KIMI_API_KEYas a bearer credential. Depending on the invoked function, the body can also contain chat messages, conversation history, translation input, system prompts, image prompts, and complete local image contents encoded as base64.Sending this information to the documented default K ...[truncated 1927 chars]
- Remediation
View remediation
Remediation Suggestions
- Allowlist the production endpoint. Accept
https://api.kimi.com/codingby default and reject unrecognized hosts unless custom endpoints are an explicit functional requirement. - Require secure transport. Parse the configured value with
URLand require thehttps:protocol. Reject embedded credentials, fragments, and unexpected ports. - Separate credentials by destination. Never forward the production Kimi credential to arbitrary custom endpoints. Require a separately configured credential for each approved custom host.
- Require explicit unsafe opt-in. If custom hosts must remain supported, require a dedicated flag such as
KIMI_ALLOW_CUSTOM_HOST=trueand display the exact destination before transmitting credentials or files. - Confirm file uploads. Clearly notify users that local image contents will be uploaded to the configured host, particularly when it differs from the documented default.
- Apply redirect restrictions. Ensure requests do not follow redirects to untrusted origins while retaining the authorization header. Prefer disabling redirects or validating every redirect destination.
- Minimize credential scope. Use narrowly scoped, revocable API keys with quotas and server-side destination or account restrictions where supported.
- Add automated tests. Verify rejection of HTTP URLs, unknown domains, embedded URL credentials, unusual ports, malformed URLs, and redirects to untrusted origins.
- Allowlist the production endpoint. Accept