T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/lib/providers.mjs:294
- Finding
- Unrestricted Ark endpoint override can disclose API credentials and user images## Vulnerability Details **File Location**: `scripts/lib/providers.mjs:294-301` **Vulnerability Type**: Unvalidated sensitive-data destination **Risk Level**: High ### Vulnerable Code ```js const base = env.ARK_BASE_URL || 'https://ark.cn-beijing.volces.com/api/v3' const body = { model: ark.model(), prompt: req.prompt, size: req.size || '2K', response_format: 'url', watermark: false, } if (req.images?.length) body.image = await Promise.all(req.images.map(asDataUri)) const j = await postJson(`${base}/images/generations`, body, { authorization: `Bearer ${env.ARK_API_KEY}` }, req.timeoutMs) ``` ### Technical Analysis `ARK_BASE_URL` is taken directly from the process environment and used as the destination for an authenticated HTTP request. The value is not validated for: - An HTTPS scheme - An approved Ark hostname - Embedded URL credentials - Redirect or destination trust boundaries - Plaintext HTTP transport The request carries `ARK_API_KEY` as a bearer credential. It also includes the generation prompt and, when reference images are supplied, base64 or data-URI representations of local image files. Uploading prompts and selected images is necessary for cloud-based image generation. Allowing the same sensitive request to be redirected to an arbitrary endpoint is not required by the declared localization functionality and exceeds the minimum necessary trust boundary. ### Attack Path 1. An attacker influences the environment used to launch the Skill, such as through a poisoned shell configuration, CI variable, wrapper script, or deployment configuration. 2. The attacker sets `ARK_BASE_URL` to an attacker-controlled URL, potentially using plaintext HTTP. 3. The user invokes `scripts/gen.mjs` with the Ark provider, a valid `ARK_API_KEY`, and one or more proprietary reference images. 4. `asDataUri()` reads and encodes the selected local images. 5. The script sends the bearer API key, prompt, mode ...[truncated 763 chars]
- Remediation
- ## Remediation Suggestions 1. Parse the configured endpoint using `new URL()` before making any request. 2. Require the `https:` scheme and reject plaintext HTTP. 3. Reject URLs containing embedded usernames or passwords. 4. Allowlist official Ark API hostnames by default. 5. If private gateways must be supported, require an explicit opt-in flag and a separate credential intended for that gateway. 6. Display the resolved hostname before uploading local files, especially when it differs from the official provider. 7. Disable automatic redirect following for authenticated requests, or validate every redirect destination before forwarding authorization headers. 8. Add automated tests confirming that HTTP URLs, malformed URLs, and unapproved hosts are rejected. 9. Document that prompts and reference images are uploaded to the resolved provider endpoint.