T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/deep_research.py:101
- Finding
- Unrestricted Custom API Endpoint Can Receive Credentials and Research Data## Vulnerability Details **File Location**: `scripts/deep_research.py:101-109, 218-233, 878` **Vulnerability Type**: Unvalidated credential-bearing API endpoint configuration **Risk Level**: Medium ### Complete Code Snippet ```python parser.add_argument( "--api-key", default=os.getenv("OPENAI_API_KEY", ""), help="OpenAI API key. Defaults to OPENAI_API_KEY environment variable.", ) parser.add_argument( "--base-url", default=os.getenv("OPENAI_BASE_URL", ""), help="Optional custom OpenAI-compatible endpoint.", ) ``` ```python def load_openai_client(api_key: str, base_url: str, timeout: float) -> Any: if not api_key: raise DeepResearchError("Missing API key. Set OPENAI_API_KEY or pass --api-key.") try: from openai import OpenAI # type: ignore except ImportError as exc: raise DeepResearchError( "Dependency missing: openai package is not installed. " "Run: pip install -r scripts/requirements.txt" ) from exc kwargs: Dict[str, Any] = {"api_key": api_key} if base_url: kwargs["base_url"] = base_url try: kwargs["timeout"] = timeout return OpenAI(**kwargs) except TypeError: kwargs.pop("timeout", None) return OpenAI(**kwargs) ``` ```python client = load_openai_client(args.api_key, args.base_url, args.timeout) ``` ### Technical Analysis The application accepts an arbitrary API base URL from either the `--base-url` command-line option or the inherited `OPENAI_BASE_URL` environment variable. It then configures the OpenAI client with both that endpoint and the API key without enforcing HTTPS, validating the destination hostname, applying an allowlist, or warning the user that credentials and submitted content will be sent to a non-default server. Consequently, a malicious launcher, poisoned environment, unsafe wrapper script, or copied command can redirect authenticated API requests to an attacker-controlled OpenAI-compat ...[truncated 1587 chars]
- Remediation
- ## Remediation Suggestions 1. Default exclusively to the official API endpoint and do not inherit `OPENAI_BASE_URL` automatically. 2. Require a separate explicit opt-in flag before permitting custom gateways. 3. Parse and validate custom URLs before client creation: - Require HTTPS. - Reject embedded user information. - Reject malformed destinations. - Consider rejecting loopback, link-local, and private-network addresses unless explicitly required. 4. Maintain an allowlist of approved gateway hostnames in managed environments. 5. Display the effective endpoint and a clear warning that credentials and all request content will be shared with it. 6. Require interactive confirmation for unapproved endpoints where interactive execution is possible. 7. Prefer gateway-specific credentials with minimal permissions instead of reusing primary OpenAI credentials. 8. Document the trust implications of custom endpoints in `SKILL.md`. 9. Add automated tests confirming that HTTP and unapproved hosts are rejected.