T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:67
- Finding
- API Credential Can Be Redirected to an Arbitrary Host## Vulnerability Details **File Location**: `SKILL.md:67-68` **Additional Locations**: `SKILL.md:27, 93-94, 123-124, 144-145, 166-167, 187-188, 211-214, 239-240, 263-264, 284-287, 331-332` **Vulnerability Type**: Unvalidated credential-bearing endpoint override **Risk Level**: Medium ### Vulnerable Code ```bash curl -s -H "X-Shelter-Key: $SHELTER_API_KEY" \ "${SHELTER_API_URL:-https://api.shelter.money/agent}/v1/status" ``` The same endpoint override pattern is used for all documented API requests. ### Technical Analysis The Skill sends the sensitive `SHELTER_API_KEY` value in an HTTP header to a base URL controlled by the `SHELTER_API_URL` environment variable. The value is not validated, restricted to the expected `api.shelter.money` hostname, or required to use HTTPS. If an attacker can influence the agent's environment, shell configuration, process launcher, or project-specific environment settings, the attacker can set `SHELTER_API_URL` to a server under their control. The next Skill request will then disclose the API key in the `X-Shelter-Key` header. An `http://` value could additionally expose the key in plaintext to network observers. ### Attack Path 1. An attacker influences the environment in which the agent runs and sets `SHELTER_API_URL` to an attacker-controlled URL, such as `https://attacker.example/collect`. 2. The user asks the agent to check financial status, runway, alerts, or another Shelter function. 3. The agent executes the documented `curl` command. 4. `curl` sends `X-Shelter-Key: $SHELTER_API_KEY` to the attacker-controlled server. 5. The attacker captures the API key and uses it against the legitimate Shelter API, subject to the key's assigned scopes and rate limits. ### Impact Assessment Successful exploitation exposes the user's Shelter API credential. The attacker could access the financial information allowed by that key, potentially including balances, safe-to-spend amounts, e ...[truncated 409 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the endpoint override for normal use and hardcode the trusted endpoint: ```bash SHELTER_API_URL="https://api.shelter.money/agent" ``` 2. If custom endpoints are required for development, validate the parsed URL before attaching the API key: - Require the `https:` scheme. - Require an exact hostname allowlist, such as `api.shelter.money`. - Reject embedded credentials, unexpected ports, redirects to other hosts, and malformed URLs. 3. Configure `curl` to reject insecure transport and unsafe redirects. Do not forward the credential across cross-origin redirects. 4. Separate development credentials from production credentials and require an explicit development mode before permitting a non-production endpoint. 5. Document that users should rotate the API key immediately if an unexpected `SHELTER_API_URL` value may have been used. 6. Apply narrowly scoped API permissions and short credential lifetimes to reduce the impact of disclosure.