T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:30
- Finding
- Configurable API Origin Can Disclose the Moltgate API Key## Vulnerability Details **File Location**: `SKILL.md`, lines 30–35 and 48–116 **Vulnerability Type**: Unrestricted authenticated API destination **Risk Level**: High ### Vulnerable Code ```bash export MOLTGATE_BASE_URL="https://moltgate.com" ``` ```text If `MOLTGATE_BASE_URL` is not set, default to `https://moltgate.com`. ``` ```text Authorization: Bearer $MOLTGATE_API_KEY ``` Representative authenticated requests include: ```bash curl -s -H "Authorization: Bearer $MOLTGATE_API_KEY" \ "$MOLTGATE_BASE_URL/api/inbox/messages/?status=NEW" ``` ```bash curl -s -X PATCH \ -H "Authorization: Bearer $MOLTGATE_API_KEY" \ -H "Content-Type: application/json" \ -d '{"inbox_status":"DELIVERED"}' \ "$MOLTGATE_BASE_URL/api/inbox/messages/{id}/update_status/" ``` ```bash curl -s -H "Authorization: Bearer $MOLTGATE_API_KEY" \ "$MOLTGATE_BASE_URL/api/offers/" ``` ### Technical Analysis The Skill permits `MOLTGATE_BASE_URL` to override the API origin, but does not require HTTPS or validate the destination hostname before attaching `MOLTGATE_API_KEY` as a bearer credential. The default origin is legitimate, but an altered environment can redirect all documented authenticated requests to an arbitrary server. This behavior exceeds minimum privilege. Supporting the declared Moltgate integration requires sending the credential only to the trusted Moltgate API, not to an unrestricted configurable origin. Because bearer tokens grant access to whoever possesses them, an attacker-controlled destination can capture and reuse the key. An `http://` value could also expose it through plaintext interception. ### Attack Path 1. An attacker, compromised launcher, deployment configuration, or unsafe setup changes `MOLTGATE_BASE_URL` to an attacker-controlled HTTPS endpoint or a plaintext HTTP endpoint. 2. The user invokes the Skill to list offers, fetch paid tasks, inspect task details, or update task status. 3. The Agent follows the documented `curl` command and attache ...[truncated 890 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `MOLTGATE_BASE_URL` configurability if alternate API origins are not operationally required, and use the fixed trusted endpoint `https://moltgate.com`. 2. If configurability is required, parse and validate the URL before any authenticated request: - Require the `https` scheme. - Allowlist the exact expected hostname or a narrowly defined set of trusted hosts. - Reject URL user information, nonstandard destinations, fragments, and ambiguous host representations. - Do not rely on substring or suffix checks that can accept attacker domains. 3. Prevent credentials from crossing origins through redirects. Disable redirects or independently validate every redirect destination before forwarding the authorization header. 4. Harden documented `curl` invocations, for example with `--proto '=https' --proto-redir '=https' --max-redirs 0`, in addition to hostname validation. 5. Keep credential attachment conditional: add the `Authorization` header only after the final request origin has passed validation. 6. Apply least privilege to `MOLTGATE_API_KEY`, rotate any key suspected of exposure, and monitor for access from unexpected origins or clients. 7. Add explicit Skill instructions forbidding users and untrusted task content from changing the API origin.