T09 · Insecure Skill Coding Practices
- Location
SKILL.md:15- Finding
Bearer Token May Be Forwarded to an Untrusted or Plaintext Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:15-18,SKILL.md:112-116, andapi_reference.md:9-12
Vulnerability Type: Unrestricted credential destination and insufficient transport security
Risk Level: HighVulnerable Code
yaml metadata: openclaw: baseUrl: "${AIWORK_BASE_URL:-https://aiworks.cn}" requires: env: ["AIWORK_AUTH_TOKEN"] optionalEnv: ["AIWORK_BASE_URL"]text Authorization: Bearer ${AIWORK_AUTH_TOKEN}text Base URL: `${AIWORK_BASE_URL:-https://aiworks.cn}`The API reference additionally declares both HTTP and HTTPS as supported protocols at
api_reference.md:9while requiring bearer authentication atapi_reference.md:12.Technical Analysis
The API destination is controlled through the optional
AIWORK_BASE_URLenvironment variable. Protected API requests are instructed to carryAIWORK_AUTH_TOKENas a bearer credential, but the Skill does not specify any validation of the configured URL.In particular, the documented behavior does not:
- Require the configured URL to use HTTPS.
- Restrict the hostname to an approved set of API origins.
- Prevent credentials from being sent after a cross-origin redirect.
- Require certificate or final-origin validation before attaching the authorization header.
Because bearer tokens grant access based solely on possession, sending one to an attacker-controlled host or over plaintext HTTP immediately compromises the credential. Exploitation requires the attacker to influence the Skill's environment, configuration, or request destination.
Attack Path
- An attacker or compromised component modifies
AIWORK_BASE_URLto reference an attacker-controlled server or a plaintext HTTP endpoint. - The agent constructs protected API requests using the modified base URL.
- The agent attaches
Authorization: Bearer ${AIWORK_AUTH_TOKEN}as instructed. - The attacker-controlled ...[truncated 882 chars]
- Remediation
View remediation
Remediation Suggestions
- Require
AIWORK_BASE_URLto use HTTPS and reject HTTP URLs before making any request. - Allowlist the expected API hostname, such as
aiworks.cn, and explicitly approved subdomains. - Normalize and validate the URL before use, including its scheme, hostname, port, and user-information fields.
- Disable automatic redirects for authenticated requests, or validate every redirect target and remove the authorization header whenever the origin changes.
- Attach
Authorizationonly after the final destination has passed origin validation. - Reject URLs containing embedded credentials, unexpected ports, loopback addresses, private network addresses, or alternate hostname representations unless explicitly required.
- Update
api_reference.mdto require HTTPS for every authenticated endpoint. - Rotate and revoke any token suspected of having been transmitted to an untrusted or plaintext endpoint.
- Require