T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/report.sh:6- Finding
Unvalidated Custom Gateway Can Receive Bearer Credentials and Prompt Data
- Content
View full analysis
/dev/null || \ curl -s "${GATEWAY_URL}/api/report" \ -H "Authorization: Bearer ${PURA_API_KEY}" echo "" echo "=== INCOME STATEMENT ===" curl -s "${GATEWAY_URL}/api/income" \ -H "Authorization: Bearer ${PURA_API_KEY}" | python3 -m json.tool 2>/dev/null || \ curl -s "${GATEWAY_URL}/api/income" \ -H "Authorization: Bearer ${PURA_API_KEY}" ``` From `scripts/verify.sh`: ```bash GATEWAY_URL="${PURA_GATEWAY_URL:-https://api.pura.xyz}" # 1. Ensure we have an API key if [[ -z "${PURA_API_KEY:-}" ]]; then echo "No PURA_API_KEY set. Generating one..." RESPONSE=$(curl -s -X POST "${GATEWAY_URL}/api/keys" \ -H "Content-Type: application/json" \ -d '{"label":"openclaw-verify"}') PURA_API_KEY=$(echo "$RESPONSE" | grep -o '"key":"[^"]*"' | head -1 | cut -d'"' -f4) if [[ -z "$PURA_API_KEY" ]]; then echo "✗ Failed to generate key. Response: $RESPONSE" exit 1 fi echo "✓ Generated key: ${PURA_API_KEY:0:13}..." echo "" echo " export PURA_API_KEY=\"$PURA_API_KEY\"" echo "" fi # 2. Health check echo "Checking gateway health..." HEALTH=$(curl -s "${GATEWAY_URL}/api/health" 2>/dev/null || echo '{"status":"error"}') if echo "$HEALTH" | grep -q '"ok"'; then echo "✓ Gateway is operational" else echo "✗ Gateway health check failed: $HEALTH" exit 1 fi # 3. Send a real inference request echo "" echo "Sending inference request..." RESPONSE=$(curl -s -w "\ ...[truncated 2236 chars]- Remediation
View remediation