T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:28- Finding
Bearer Token Disclosure Through an Unvalidated Configurable Service Endpoint
- Content
View full analysis
}" curl -s -X POST "$MCD_URL" \ -H "$MCD_AUTH" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"<工具名>","arguments":{<参数>}},"id":1}' ``` The optional configuration at line 28 permits `MCD_MCP_URL` to replace the default endpoint: ```text - `MCD_MCP_URL`: MCP service address, default `https://mcp.mcd.cn` ``` ### Technical Analysis The Skill constructs the destination URL directly from the configurable `MCD_MCP_URL` environment variable and sends the `MCD_TOKEN` bearer credential to that destination. It does not validate the URL scheme, hostname, port, or origin before attaching the authorization header. Consequently, any party capable of influencing the Skill configuration can redirect authenticated requests to a server under that party's control. The issue includes both malicious HTTPS endpoints and plaintext HTTP endpoints, because the instructions impose no HTTPS-only requirement. This is an insecure configuration and credential-handling pattern. The endpoint override may be intended to support custom MCP deployments, but sensitive credentials must not be forwarded to arbitrary destinations without validation and explicit authorization. ### Attack Path 1. An attacker persuades a user or administrator to configure `MCD_MCP_URL` with an attacker-controlled URL, or modifies the relevant environment configuration through some existing configuration access. 2. The user asks the Agent to perform a supported operation, such as listing or binding coupons. 3. Following the Skill instructions, the Agent resolves `MCD_URL` from the attacker-controlled `MCD_MCP_URL`. 4. The Agent constructs ...[truncated 1124 chars]- Remediation
View remediation