T09 · Insecure Skill Coding Practices
Warning
- Location
- skill.js:3
- Finding
- Unrestricted TTS Endpoint May Expose Dialogue and API Credentials## Vulnerability Details **File Location**: `skill.js`, lines 3–16 **Vulnerability Type**: Unvalidated external endpoint and sensitive-data transmission **Risk Level**: Medium ### Vulnerable Code ```js const { dialogue } = inputs; const API_KEY = env.API_KEY; const API_BASE = env.API_BASE; const MODEL_NAME = env.MODEL_NAME; const res = await fetch(`${API_BASE}/tts`, { method: "POST", headers: { "Authorization": "Bearer " + API_KEY, "Content-Type": "application/json" }, body: JSON.stringify({ model: MODEL_NAME, text: dialogue }) }); ``` ### Technical Analysis The Skill sends the user-provided dialogue and an API key to a URL constructed directly from the environment-controlled `API_BASE` value. It does not parse or validate the URL, enforce HTTPS, restrict the destination hostname, reject embedded credentials, or limit the destination port. Sending dialogue to an external service is necessary for the declared remote TTS functionality. However, allowing an unrestricted destination exceeds the minimum safe network scope. A malicious or compromised configuration can redirect the request to an attacker-controlled endpoint. If an `http://` URL is accepted, the bearer credential and dialogue can also traverse the network without transport encryption. ### Attack Path 1. An attacker compromises deployment configuration or otherwise gains influence over `API_BASE`. 2. The attacker changes `API_BASE` to an attacker-controlled server or a plaintext HTTP endpoint. 3. A user invokes the Skill with dialogue that may contain confidential content. 4. The Skill sends the dialogue in the JSON request body and `API_KEY` in the `Authorization` header to the configured endpoint. 5. The attacker captures the dialogue and bearer credential and may reuse the credential within the permissions granted by the TTS provider. ### Impact Assessment Successful exploitation can disclose user dial ...[truncated 598 chars]
- Remediation
- ## Remediation Suggestions 1. Parse `API_BASE` with `new URL()` and reject malformed values. 2. Require the `https:` protocol; reject plaintext HTTP and all unexpected schemes. 3. Enforce an explicit allowlist of approved TTS provider hostnames rather than accepting arbitrary destinations. 4. Reject embedded URL credentials, unexpected ports, and hosts resolving to loopback, link-local, or private network ranges unless such access is explicitly required. 5. Use a provider-specific, least-privileged API key with restricted capabilities and quotas, and rotate it if exposure is suspected. 6. Document clearly that dialogue is transmitted to an external TTS provider and may be subject to that provider's retention and privacy policies. 7. Validate required environment values at startup and fail closed when endpoint validation fails. 8. Avoid logging the authorization header, API key, dialogue, or full request payload.