T09 · Insecure Skill Coding Practices
Error
- Location
scripts/moltbook_ops.py:25- Finding
Bearer Credential Can Be Redirected to an Arbitrary Network Destination
- Content
View full analysis
None: if not api_key: raise SystemExit("Missing Moltbook API key. Pass --api-key or set MOLTBOOK_API_KEY.") self.api_key = api_key self.base = base.rstrip("/") def request(self, method: str, path: str, payload: Optional[Dict[str, Any]] = None) -> Any: url = f"{self.base}{path}" data = None headers = { "Authorization": f"Bearer {self.api_key}", "User-Agent": "openclaw-moltbook-ops/1.2", } if payload is not None: data = json.dumps(payload).encode("utf-8") headers["Content-Type"] = "application/json" req = urllib.request.Request(url, data=data, headers=headers, method=method) try: with urllib.request.urlopen(req, timeout=30) as resp: ``` The command-line parser and client initialization also accept the base URL without validation: ```python p.add_argument("--base", default=DEFAULT_BASE) ``` ```python client = MoltbookClient(api_key=args.api_key, base=args.base) ``` ### Technical Analysis The client unconditionally adds the Moltbook bearer credential to every request. At the same time, the request origin is controlled by the `MOLTBOOK_BASE` environment variable or the `--base` command-line argument. There is no validation that: - The scheme is HTTPS. - The destination hostname is the official Moltbook hostname. - The destination port is appropriate. - The URL does not contain user information or other ambiguous com ...[truncated 1995 chars]- Remediation
View remediation