T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/uexx_client.py:10
- Finding
- API Key Can Be Transmitted to an Arbitrary or Unencrypted Origin<![CDATA[ ## Vulnerability Details **File Location**: `scripts/uexx_client.py`, lines 10–28 **Vulnerability Type**: Unrestricted credential destination and insufficient transport validation **Risk Level**: Medium ### Vulnerable Code ```python BASE_URL = os.environ.get("UEXX_DATA_BASE_URL", "https://bbs.uexx.com").rstrip("/") STATE_DIR = Path(os.environ.get("UEXX_DATA_STATE_DIR", Path.home() / ".uexx-data-cloud")) KEY_FILE = STATE_DIR / "free_key.json" class UEXXError(RuntimeError): pass def request_json(path: str, method: str = "GET", api_key: str | None = None, body: dict[str, Any] | None = None) -> dict[str, Any]: data = None headers = {"Accept": "application/json"} if api_key: headers["X-API-Key"] = api_key if body is not None: data = json.dumps(body).encode("utf-8") headers["Content-Type"] = "application/json" req = urllib.request.Request(BASE_URL + path, data=data, headers=headers, method=method) ``` ### Technical Analysis The API base URL is taken directly from the `UEXX_DATA_BASE_URL` environment variable without validation of its scheme, hostname, port, or trust level. The same request function attaches the locally cached API key to the `X-API-Key` header and sends it to the configured destination. Although sending an API key to the declared UEXX service is necessary for authenticated market-data queries, allowing the credential destination to be replaced by any environment-provided URL exceeds the minimum privilege required for normal operation. A value using `http://` would also transmit the credential without TLS protection. Exploitation requires influence over the process environment or its launcher configuration. This is a meaningful trust-boundary issue in shared automation, CI, plugin hosts, or agent runtimes where environment settings may be inherited from a less-trusted source. ### Attack Path 1. The Skill has already obtained and cached a valid Free API key. 2. An attacker or compromi ...[truncated 852 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Pin authenticated production requests to `https://bbs.uexx.com`. - If a configurable base URL is required for development, require an explicit development-mode opt-in. - Parse the URL before use and enforce: - The `https` scheme. - An allowlisted hostname. - An expected port. - No embedded user information. - Attach `X-API-Key` only when the final request origin exactly matches an approved credential destination. - Reject or tightly control cross-origin redirects for authenticated requests. - Keep separate credentials for production and development endpoints. - Fail closed with a clear error if the configured URL does not satisfy the trust policy. ]]>