T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/ccs_online_client.py:58
- Finding
- Full MCP Configuration and Authentication Secrets Can Be Sent to an Environment-Controlled Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ccs_online_client.py:58-105` **Vulnerability Type**: Untrusted endpoint selection and sensitive-data disclosure **Risk Level**: High ### Vulnerable Code ```python def resolve_endpoint(cli_value: str | None = None) -> str: ep = cli_value or os.environ.get("CCS_API_ENDPOINT") or DEFAULT_ENDPOINT return ep.rstrip("/") ``` ```python ep = resolve_endpoint(endpoint) data = json.dumps(body, ensure_ascii=False).encode("utf-8") if len(data) > MAX_BODY_BYTES: raise CCSAPIError(413, {"error": f"请求体超过 {MAX_BODY_BYTES} 字节上限"}) headers = {"Content-Type": "application/json; charset=utf-8", "User-Agent": "CCS-CLI/1.0 (channel=clawhub)"} api_key = os.environ.get("CCS_API_TOKEN") if api_key: headers["X-API-Key"] = api_key # A2M: payment proof from the Alipay checkout flow (official contract # header name is Payment-Proof). CCS_PAY_TOKEN kept as a legacy alias. proof = os.environ.get("CCS_PAYMENT_PROOF") or os.environ.get("CCS_PAY_TOKEN") if proof: headers["Payment-Proof"] = proof req = urllib.request.Request(ep + path, data=data, headers=headers, method="POST") ``` The online call is reached through `scripts/mcp_checkup.py:112-122` and `scripts/mcp_checkup.py:175-176` when the user supplies the explicit `--online` option. ### Technical Analysis Online mode serializes the complete input body and submits it without redaction. MCP configurations are likely to contain API keys, cloud credentials, access tokens, internal endpoint addresses, filesystem paths, and infrastructure details—the same kinds of sensitive values this Skill is designed to identify. The destination is selected in the following order: 1. The command-line `--endpoint` value. 2. The inherited `CCS_API_ENDPOINT` environment variable. 3. The hardcoded Correctover service endpoint. The resolved endpoint is not restricted to a ...[truncated 3100 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Restrict online submissions to approved destinations** - Remove `CCS_API_ENDPOINT` as an implicit environment-based override for production use. - Maintain an explicit allowlist of permitted HTTPS hostnames. - Reject URLs containing user information, unexpected ports, fragments, or non-HTTPS schemes. - Resolve and validate the final destination before constructing the request. 2. **Bind credentials to the trusted service** - Add `X-API-Key` and `Payment-Proof` only when the resolved scheme and hostname exactly match an approved service. - Never forward service credentials to arbitrary command-line or environment-supplied endpoints. - Consider separate credentials for custom/private deployments. 3. **Require informed confirmation** - Display the resolved destination hostname before transmitting data. - Require explicit confirmation when the endpoint differs from the default. - Clearly warn that online mode sends the configuration off-device and may expose embedded secrets. 4. **Minimize transmitted data** - Run local secret detection first. - Redact or tokenize detected credential values before submission. - Prefer sending only the fields required for analysis rather than the complete configuration. - Refuse online submission when high-confidence secrets are found unless the user explicitly overrides the refusal. 5. **Enforce transport security** - Reject plaintext HTTP endpoints. - Use TLS certificate verification, which is enabled by default in standard `urllib`, and do not provide insecure bypasses. - Consider certificate or public-key pinning if the operational environment supports secure pin rotation. 6. **Harden environment handling** - Treat inherited endpoint variables as untrusted input. - Log the selected endpoint hostname without logging request bodies or credentials. - In CI and agent environments, use a sanitized environment and narrowly scoped cre ...[truncated 333 chars]