T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:49
- Finding
- User-Controlled API Base URL Can Expose the Bearer Credential## Vulnerability Details **File Location**: `SKILL.md`, lines 49-51 **Vulnerability Type**: Credential disclosure through an untrusted API endpoint **Risk Level**: High ### Vulnerable Code Snippet ```markdown - **Base URL**: `https://getesimpal.com/api` (or the env override the user provides, always ending in `/api`). - **Full example**: `GET https://getesimpal.com/api/v1/plans?country=TR&min_data_gb=1` - **Auth**: Every request must include header `Authorization: Bearer ${ESIMPAL_API_KEY}`. ``` ### Technical Analysis The skill permits a user-provided base URL while also requiring every API request to include the secret `ESIMPAL_API_KEY` as a bearer token. Requiring the URL to end in `/api` only constrains its path; it does not establish that the scheme, hostname, port, or server belongs to eSIMPal. Consequently, an attacker can provide an HTTPS URL under their control, such as `https://attacker.example/api`. If the agent follows the documented override behavior, it will attach `Authorization: Bearer ${ESIMPAL_API_KEY}` to a request sent directly to the attacker. Redirect handling presents a related risk. Even if the initial origin is trusted, an HTTP client that forwards the authorization header across an origin-changing redirect could expose the credential unless redirects and header propagation are explicitly restricted. ### Attack Path 1. An attacker or untrusted user instructs the agent to use `https://attacker.example/api` as the environment-provided base URL. 2. The supplied URL passes the documented requirement because its path ends in `/api`. 3. The agent makes an otherwise legitimate API request, such as a plan lookup. 4. Following the authentication requirement, the agent includes: `Authorization: Bearer ${ESIMPAL_API_KEY}`. 5. The attacker-controlled server records the bearer credential. 6. The attacker reuses the credential against the legitimate eSIMPal API within the scopes assigned to the key. ### Impact Assessment Successful exploi ...[truncated 607 chars]
- Remediation
- ## Remediation Suggestions 1. Remove support for user-controlled API origins and use the fixed trusted endpoint `https://getesimpal.com/api`. 2. If endpoint overrides are operationally necessary, enforce an explicit allowlist of trusted origins rather than checking only the path suffix. 3. Parse and validate the URL structurally: - Require HTTPS. - Match an approved hostname exactly. - Restrict the effective port to approved values. - Reject embedded credentials, ambiguous host syntax, and unexpected URL components. - Normalize and validate the path separately. 4. Resolve the final request destination before attaching the authorization header. Reject cross-origin redirects and never forward credentials when the scheme, hostname, or port changes. 5. Prefer separate restricted credentials for approved non-production environments instead of sending a production key to an overridden endpoint. 6. Add tests confirming that attacker-controlled hosts ending in `/api`, deceptive subdomains, nonstandard ports, and cross-origin redirects cannot receive the bearer token. 7. Rotate the API key immediately if it may already have been sent to an untrusted endpoint, and review associated order activity for unauthorized operations.