T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:16
- Finding
- Environment-controlled API origin can expose authentication credentials and sensitive KYC data## Vulnerability Details **File Location**: `SKILL.md:8-9`, `SKILL.md:16-23`, `SKILL.md:27-36`, `SKILL.md:69-75` **Vulnerability Type**: Unrestricted external endpoint configuration for authenticated transmission of sensitive identity data **Risk Level**: High ### Vulnerable Code ```yaml metadata: openclaw: requires: env: - AIOT_API_BASE_URL primaryEnv: AIOT_API_BASE_URL ``` ```markdown ## Configuration The default API base URL is `https://payment-api-dev.aiotnetwork.io`. All endpoints are relative to this URL. To override (e.g. for local development): ```bash export AIOT_API_BASE_URL="http://localhost:8080" ``` If `AIOT_API_BASE_URL` is not set, use `https://payment-api-dev.aiotnetwork.io` as the base for all requests. ``` The requests directed to this configurable origin include authenticated operations and highly sensitive identity information: ```markdown - `create_masterpay_user` — Create a MasterPay user account (prerequisite for all MasterPay operations) | `POST /api/v1/masterpay/users` | Requires auth - `get_kyc_status` — Check current KYC verification status and document upload progress | `GET /api/v1/masterpay/kyc/status` | Requires auth - `get_kyc_metadata` — Get valid document types, occupations, nationalities, and countries for KYC forms | `GET /api/v1/masterpay/kyc/metadata` | Requires auth - `submit_kyc` — Submit KYC personal data for review (uses profile data) | `POST /api/v1/masterpay/kyc/submit` | Requires auth - `upload_kyc_document` — Upload a KYC document (passport, ID, proof of address) via multipart or base64 JSON | `POST /api/v1/masterpay/kyc/documents` | Requires auth - `submit_wallet_kyc` — Submit wallet-level KYC for a card wallet (requires profile phone number and identity document ID number) | `POST /api/v1/masterpay/wallets/kyc` | Requires auth - `get_profile` — Get user profile data used for KYC submission | `GET /api/v1/profile` | Requires ...[truncated 3714 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the production API to a trusted HTTPS origin rather than permitting unrestricted runtime replacement. 2. If configuration is operationally necessary, validate the resolved origin against a strict allowlist of approved scheme, hostname, and port combinations. 3. Reject plaintext HTTP for all non-loopback destinations. Permit loopback HTTP only when an explicit development mode is enabled. 4. Separate development and production configurations. Do not use a development service as the default destination for real KYC information. 5. Before transmitting identity documents, display the resolved destination to the user and require explicit confirmation if it is not the canonical production origin. 6. Ensure authorization headers are attached only to approved origins and are removed during redirects to any different origin. 7. Disable cross-origin redirects for authenticated KYC requests or revalidate every redirect target against the allowlist. 8. Use short-lived, audience-restricted bearer tokens with the minimum required API privileges, and provide immediate revocation when endpoint compromise is suspected. 9. Add deployment-time and runtime tests that reject malicious hostnames, user-information URL tricks, nonstandard ports, plaintext remote URLs, and redirect-based origin changes. 10. Document that synthetic data must be used in development and local testing environments.