T09 · Insecure Skill Coding Practices
Error
- Location
scripts/check_bets.sh:31- Finding
Unvalidated API endpoint override can exfiltrate authentication credentials and sensitive account data
- Content
View full analysis
/dev/null) ``` #### `scripts/my_stats.sh:31,67-68` ```bash API_BASE="${FUKU_API_URL:-https://cbb-predictions-api-nzpk.onrender.com}" RESPONSE=$(curl -sS "${API_BASE}/api/dawg-pack/agents/${AGENT_NAME}" \ -H "X-Dawg-Pack-Key: ${API_KEY}" 2>/dev/null) ``` #### `scripts/check_notifications.sh:50,84-86,127-132` ```bash API_BASE="${FUKU_API_URL:-https://cbb-predictions-api-nzpk.onrender.com}" RESPONSE=$(curl -s -w "\n%{http_code}" \ -H "X-Dawg-Pack-Key: ${FUKU_API_KEY}" \ "$URL") ACK_RESPONSE=$(curl -s -w "\n%{http_code}" \ -X POST \ -H "X-Dawg-Pack-Key: ${FUKU_API_KEY}" \ -H "Content-Type: application/json" \ -d "{\"ids\": $IDS_JSON}" \ "${API_BASE}/api/dawg-pack/notifications/ack") ``` #### `scripts/post_pick.sh:42,202-205,244-247` ```bash API_BASE="${FUKU_API_URL:-https://cbb-predictions-api-nzpk.onrender.com}" RESPONSE=$(curl -sS -X POST "${API_BASE}/api/dawg-pack/posts" \ -H "X-Dawg-Pack-Key: ${API_KEY}" \ -H "Content-Type: application/json" \ -d "$(jq -n \ ... )" 2>/dev/null) BET_RESPONSE=$(curl -sS -X POST "${API_BASE}/api/dawg-pack/bets" \ -H "X-Dawg-Pack-Key: ${API_KEY}" \ -H "Content-Type: application/json" \ -d "$(jq -n \ ... )" 2>/dev/null) ``` #### `scripts/register.sh:37,125-139,183-190` ```bash API_BASE="${FUKU_API_URL:-https://cbb-predict ...[truncated 4602 chars]- Remediation
View remediation
&2 exit 1 ;; esac ``` 3. **Separate development credentials from production credentials** If local or staging endpoints must be supported, require a dedicated test mode and refuse to load `~/.fuku/agent.json` in that mode. Use separate, limited-scope credentials. 4. **Require HTTPS** Reject plaintext HTTP and non-HTTP schemes. Validate the final request URL before invoking `curl`. 5. **Apply least-privilege credentials** Use separate API tokens for read-only account access, posting, betting, notifications, and wallet operations. A key used to view statistics should not authorize account mutations. 6. **Harden network requests** Add strict failure handling and protocol restrictions: ```bash curl --fail-with-body \ --silent \ --show-error \ --proto '=https' \ --tlsv1.2 \ ... ``` 7. **Protect environment-controlled execution** Launch the Skill with a sanitized environment and explicitly remove unexpected endpoint variables: ```bash unset FUKU_API_URL ``` 8. **Rotate potentially exposed keys** Users who have run authenticated scripts with an untrusted or unexpected `FUKU_API_URL` should revoke and replace their API ke ...[truncated 84 chars]