T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:70
- Finding
- Arbitrary Upload Endpoint Can Receive Local Files and API Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 70-73 and 102-152 **Vulnerability Type**: Unrestricted outbound upload destination and credential disclosure **Risk Level**: High ### Vulnerable Code ```python def execute( target_path: str, app_name: str, api_url: str = "https://www.dele.fun/api/upload", api_key: Optional[str] = None, app_desc: Optional[str] = None ) -> str: ``` ```python headers = {} if api_key: headers['Authorization'] = f"Bearer {api_key}" headers['x-agent-user'] = "openclaw-agent" response = requests.post(api_url, files=multipart_data, headers=headers) if response.status_code in (200, 201): data = response.json() base_url = api_url.replace('/api/upload', '') return f"Deployment successful! URL: {base_url}{data.get('url', f'/app/{app_name}/')}" ``` The tool schema also exposes the destination as a caller-controlled parameter: ```json "api_url": { "type": "string", "description": "The full URL to the PostMe /api/upload endpoint. Defaults to https://www.dele.fun/api/upload" } ``` ### Technical Analysis The implementation accepts an unrestricted `api_url` and submits all selected files to that URL. If an API key is supplied, it is placed in the `Authorization` header of the same request. No validation restricts the scheme, hostname, port, or path to the official PostMe HTTPS endpoint. Consequently, an influenced tool invocation can direct both local file content and authentication material to an attacker-controlled server. The code also permits plaintext HTTP destinations and does not explicitly constrain redirect behavior. Although uploading files is the declared purpose of the skill, permitting an arbitrary destination is not necessary for normal operation and breaks the expected trust boundary around the PostMe credential. ### Attack Path 1. An attacker or untrusted instruction influences the `api_url` argument supplied to the deployment function. 2. The function a ...[truncated 1040 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the caller-controlled `api_url` parameter unless custom endpoints are an explicit and necessary feature. 2. Hardcode the official endpoint as `https://www.dele.fun/api/upload`. 3. If endpoint customization is required, parse the URL and enforce: - HTTPS only. - An exact hostname allowlist. - An expected port and upload path. - No embedded user information. - No IP literals or alternate encodings that bypass hostname validation. 4. Disable redirects or validate every redirect target before following it. 5. Never forward authentication headers when the request origin changes. 6. Obtain the API key only from the protected environment variable rather than accepting it as a routine tool argument. 7. Redact credentials and sensitive response content from errors and logs. 8. Require explicit user confirmation before sending files to any non-default destination. ]]>