T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/check_bets.sh:31
- Finding
- Unvalidated API endpoint override can exfiltrate authentication credentials and sensitive account data<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/check_bets.sh:31,57-58` - `scripts/my_stats.sh:31,67-68` - `scripts/check_notifications.sh:50,84-86,127-132` - `scripts/post_pick.sh:42,202-205,244-247` - `scripts/register.sh:37,125-139,183-190` **Vulnerability Type**: Unvalidated destination for authenticated and sensitive network requests **Risk Level**: High ### Vulnerable Code #### `scripts/check_bets.sh:31,57-58` ```bash API_BASE="${FUKU_API_URL:-https://cbb-predictions-api-nzpk.onrender.com}" RESPONSE=$(curl -sS "${API_BASE}/api/dawg-pack/agents/${AGENT_NAME}" \ -H "X-Dawg-Pack-Key: ${API_KEY}" 2>/dev/null) ``` #### `scripts/my_stats.sh:31,67-68` ```bash API_BASE="${FUKU_API_URL:-https://cbb-predictions-api-nzpk.onrender.com}" RESPONSE=$(curl -sS "${API_BASE}/api/dawg-pack/agents/${AGENT_NAME}" \ -H "X-Dawg-Pack-Key: ${API_KEY}" 2>/dev/null) ``` #### `scripts/check_notifications.sh:50,84-86,127-132` ```bash API_BASE="${FUKU_API_URL:-https://cbb-predictions-api-nzpk.onrender.com}" RESPONSE=$(curl -s -w "\n%{http_code}" \ -H "X-Dawg-Pack-Key: ${FUKU_API_KEY}" \ "$URL") ACK_RESPONSE=$(curl -s -w "\n%{http_code}" \ -X POST \ -H "X-Dawg-Pack-Key: ${FUKU_API_KEY}" \ -H "Content-Type: application/json" \ -d "{\"ids\": $IDS_JSON}" \ "${API_BASE}/api/dawg-pack/notifications/ack") ``` #### `scripts/post_pick.sh:42,202-205,244-247` ```bash API_BASE="${FUKU_API_URL:-https://cbb-predictions-api-nzpk.onrender.com}" RESPONSE=$(curl -sS -X POST "${API_BASE}/api/dawg-pack/posts" \ -H "X-Dawg-Pack-Key: ${API_KEY}" \ -H "Content-Type: application/json" \ -d "$(jq -n \ ... )" 2>/dev/null) BET_RESPONSE=$(curl -sS -X POST "${API_BASE}/api/dawg-pack/bets" \ -H "X-Dawg-Pack-Key: ${API_KEY}" \ -H "Content-Type: application/json" \ -d "$(jq -n \ ... )" 2>/dev/null) ``` #### `scripts/register.sh:37,125-139,183-190` ```bash API_BASE="${FUKU_API_URL:-https://cbb-predict ...[truncated 4602 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin authenticated requests to the production HTTPS origin** Do not permit environment variables to override the destination of requests carrying production credentials: ```bash readonly API_BASE="https://cbb-predictions-api-nzpk.onrender.com" ``` 2. **If overrides are required, enforce an explicit allowlist** Validate both the scheme and exact hostname before reading or attaching credentials: ```bash DEFAULT_API_BASE="https://cbb-predictions-api-nzpk.onrender.com" API_BASE="${FUKU_API_URL:-$DEFAULT_API_BASE}" case "$API_BASE" in "https://cbb-predictions-api-nzpk.onrender.com") ;; *) echo "Error: Untrusted API endpoint: $API_BASE" >&2 exit 1 ;; esac ``` 3. **Separate development credentials from production credentials** If local or staging endpoints must be supported, require a dedicated test mode and refuse to load `~/.fuku/agent.json` in that mode. Use separate, limited-scope credentials. 4. **Require HTTPS** Reject plaintext HTTP and non-HTTP schemes. Validate the final request URL before invoking `curl`. 5. **Apply least-privilege credentials** Use separate API tokens for read-only account access, posting, betting, notifications, and wallet operations. A key used to view statistics should not authorize account mutations. 6. **Harden network requests** Add strict failure handling and protocol restrictions: ```bash curl --fail-with-body \ --silent \ --show-error \ --proto '=https' \ --tlsv1.2 \ ... ``` 7. **Protect environment-controlled execution** Launch the Skill with a sanitized environment and explicitly remove unexpected endpoint variables: ```bash unset FUKU_API_URL ``` 8. **Rotate potentially exposed keys** Users who have run authenticated scripts with an untrusted or unexpected `FUKU_API_URL` should revoke and replace their API ke ...[truncated 84 chars]