T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:425
- Finding
- Weak broker endpoint validation may expose Alpaca credentials to an attacker-controlled server## Vulnerability Details **File Location**: `SKILL.md:23-25`, `SKILL.md:73`, and `SKILL.md:425-435` **Vulnerability Type**: Improper validation of a security-sensitive network endpoint **Risk Level**: High ### Vulnerable Code ```text > **Paper trading only.** This skill must never execute against a live brokerage > endpoint. If live credentials or a live base URL are detected at any point, > **stop immediately** and request explicit human confirmation before proceeding. ``` ```text 2. Confirm APCA_API_BASE_URL == https://paper-api.alpaca.markets — halt if live ``` ```text ### Execution Checklist Before Any Order ``` ✓ BASE_URL contains "paper-api" — never "api.alpaca.markets" ✓ account.status == "ACTIVE" ✓ account.trading_blocked == false ✓ Buying power sufficient for order ✓ Position limit not exceeded (check open positions count) ✓ Order is LIMIT type ✓ client_order_id set to trace order in journal ``` ``` ### Technical Analysis The Skill provides inconsistent endpoint-validation requirements. The boot procedure requires exact equality with `https://paper-api.alpaca.markets`, while the execution checklist only requires that the configured URL contain the string `paper-api`. Substring matching is not a valid origin-validation mechanism. Attacker-controlled hosts such as `https://paper-api.attacker.example` or `https://attacker.example/paper-api` contain the required text but are not Alpaca endpoints. If the referenced broker helper implements the execution checklist literally, it could attach Alpaca authentication credentials to requests sent to an attacker-controlled server. The statement permitting execution to proceed after human confirmation when a live endpoint is detected also conflicts with the declared invariant that the Skill must never execute against a live brokerage endpoint. Network access and paper-account credentials are necessary for the declared paper-trading function, but access ...[truncated 1559 chars]
- Remediation
- ## Remediation Suggestions 1. Parse the endpoint as a URL and require exact matches for all security-sensitive components: - Scheme: `https` - Hostname: `paper-api.alpaca.markets` - Effective port: `443` - No embedded username or password 2. Use an immutable allowlist containing only the exact origin `https://paper-api.alpaca.markets`. 3. Do not accept suffix, prefix, substring, path, wildcard, or regular-expression approximations of the hostname. 4. Disable cross-origin redirects or revalidate the destination origin before following every redirect. Never forward authentication headers to another origin. 5. Remove the human-confirmation exception for live endpoints. A paper-only Skill should reject live endpoints unconditionally. 6. Enforce paper mode inside the broker helper immediately before every authenticated request and order submission, rather than relying only on natural-language instructions. 7. Fail closed when the URL is missing, malformed, ambiguous, or cannot be normalized safely. 8. Add tests covering hostile values such as `paper-api.attacker.example`, `attacker.example/paper-api`, HTTP endpoints, alternate ports, user-information syntax, and cross-origin redirects. 9. Use paper-only API credentials with the narrowest permissions supported by the broker and ensure secrets are never included in journal output or error messages.