T09 · Insecure Skill Coding Practices
- Location
SKILL.md:67- Finding
Bearer credential may be transmitted to an unrestricted API origin
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 67-70; the unrestrictedCLAWSITE_API_URLconfiguration is documented at line 35
Vulnerability Type: Unvalidated destination for authenticated requests
Risk Level: Mediumbash curl -X POST "$CLAWSITE_API_URL/v1/sites/$CLAWSITE_SITE_ID/deploy" \ -H "Authorization: Bearer $CLAWSITE_API_KEY" \ -H "Content-Type: application/zip" \ --data-binary "@site.zip"Technical Analysis
The deployment instructions construct the request destination directly from the environment-controlled
CLAWSITE_API_URLand attach the secretCLAWSITE_API_KEYas a bearer token. The instructions do not require validation of the URL scheme or hostname before the authorization header and website archive are transmitted.Although overriding the API URL can legitimately support development environments, accepting an arbitrary origin creates a credential-disclosure risk. An attacker who can influence the agent's environment, execution wrapper, or copied command can redirect the authenticated request to an attacker-controlled endpoint.
Attack Path
- An attacker or compromised environment sets
CLAWSITE_API_URLto an attacker-controlled HTTPS endpoint. - The agent follows the documented deployment workflow without validating the destination.
curlsends both theAuthorization: Bearerheader and the ZIP archive to the malicious endpoint.- The attacker extracts the API key and site contents.
- The attacker reuses the key against the legitimate ClawSite API to inspect account metadata, replace the hosted site, purge its cache, or invoke site deletion where permitted.
Impact Assessment
Exploitation exposes the ClawSite bearer credential and the complete uploaded static-site archive. Within the permissions granted to that API key, an attacker may replace public content, enumerate associated sites, purge caches, and potentially permanently delete the ...[truncated 269 chars]
- An attacker or compromised environment sets
- Remediation
View remediation
Remediation Suggestions
- Resolve the API endpoint once before constructing authenticated requests.
- Require an
httpsscheme. - Allow only explicitly trusted hosts, such as
api.clawsite.aiandapi.dev.clawsite.ai. - Reject URLs containing embedded credentials, unexpected ports, fragments, or unapproved redirect destinations.
- Configure
curlto fail safely and avoid forwarding authentication headers across redirects. Prefer disabling redirects unless they are strictly required. - Do not add the bearer header until endpoint validation succeeds.
- Clearly separate production and development configuration rather than documenting arbitrary API origins.
- Rotate the API key immediately if a deployment request may have been sent to an untrusted destination.