T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/uexx_client.py:10- Finding
API Key Can Be Transmitted to an Arbitrary or Unencrypted Origin
- Content
View full analysis
dict[str, Any]: data = None headers = {"Accept": "application/json"} if api_key: headers["X-API-Key"] = api_key if body is not None: data = json.dumps(body).encode("utf-8") headers["Content-Type"] = "application/json" req = urllib.request.Request(BASE_URL + path, data=data, headers=headers, method=method) ``` ### Technical Analysis The API base URL is taken directly from the `UEXX_DATA_BASE_URL` environment variable without validation of its scheme, hostname, port, or trust level. The same request function attaches the locally cached API key to the `X-API-Key` header and sends it to the configured destination. Although sending an API key to the declared UEXX service is necessary for authenticated market-data queries, allowing the credential destination to be replaced by any environment-provided URL exceeds the minimum privilege required for normal operation. A value using `http://` would also transmit the credential without TLS protection. Exploitation requires influence over the process environment or its launcher configuration. This is a meaningful trust-boundary issue in shared automation, CI, plugin hosts, or agent runtimes where environment settings may be inherited from a less-trusted source. ### Attack Path 1. The Skill has already obtained and cached a valid Free API key. 2. An attacker or compromi ...[truncated 852 chars]- Remediation
View remediation