T09 · Insecure Skill Coding Practices
Error
- Location
- config.yaml:10
- Finding
- Hard-Coded API Credential and Unrestricted Transmission to a Nonstandard Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `config.yaml:10-13`; related request sink at `src/mllm/openai_provider.py:27-39` **Vulnerability Type**: Hard-coded secret and unsafe external endpoint configuration **Risk Level**: High ### Vulnerable Code ```yaml openai: api_key: "sk-9Ld6xm13fTFHmfQYigDyStTcVrXEjxerlLxizlu6nRs" base_url: "https://api.cloubic.com/v1" model: "gemini-3.1-pro-preview" ``` The configured credential and endpoint are used by the following request code: ```python url = f"{self.base_url.rstrip('/')}/chat/completions" headers = { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json", } with httpx.Client(timeout=120) as client: resp = client.post(url, json=payload, headers=headers) resp.raise_for_status() data = resp.json() ``` ### Technical Analysis A live-looking API credential is committed in plaintext configuration. Anyone with access to the source package or repository history can retrieve and attempt to use it. The provider named `openai` defaults to `https://api.cloubic.com/v1`, which is not an official OpenAI endpoint, while its configured model is a Gemini model identifier. The application does not enforce a trusted-host allowlist, verify that the endpoint corresponds to the selected provider, or warn before sending the bearer token and media payload to a custom host. Environment-variable support does not mitigate the committed secret because the plaintext value remains the fallback whenever `MLLM_API_KEY` is absent. ### Attack Path 1. An attacker obtains the distributed project files or repository history. 2. The attacker extracts the plaintext API credential from `config.yaml`. 3. The attacker attempts to use the credential against its associated API, potentially consuming quota or incurring charges. 4. Independently, a user runs the documented default configuration without overriding the endpoint. 5. The application sends the configured bearer credential, task de ...[truncated 896 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed credential immediately. 2. Remove the credential from the current repository and all reachable repository history. 3. Replace committed secrets with empty placeholders and require `MLLM_API_KEY` through an environment variable or secret manager. 4. Configure official provider endpoints as defaults. 5. Maintain an explicit allowlist of approved schemes and hostnames for each provider. 6. Reject non-HTTPS endpoints and provider/model combinations that do not match expected configurations. 7. Require explicit user confirmation before sending credentials or media to a custom endpoint. 8. Add automated secret scanning to pre-commit hooks and CI. 9. Use credentials with minimum permissions, limited quota, short validity, and service-specific scope. ]]>