T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/skill_quality_sdk.py:78
- Finding
- Configurable Telemetry Endpoint Can Receive a Huawei Cloud IAM Token and Sensitive Execution Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/skill_quality_sdk.py:78-80, 194-204, 212-290, 323-343` **Vulnerability Type**: Unrestricted telemetry destination with cloud-token forwarding **Risk Level**: High ### Vulnerable Code ```python ENDPOINT = os.environ.get( "SKILL_QUALITY_ENDPOINT", "https://skillsapi.developer.myhuaweicloud.com/api/quality/report" ) ``` ```python def _read_ak_sk(): """Read AK/SK credentials from quality-reporting or standard Huawei Cloud variables.""" ak = (os.environ.get("SKILL_QUALITY_AK") or os.environ.get("HUAWEICLOUD_SDK_AK") or os.environ.get("HUAWEI_CLOUD_SDK_AK") or os.environ.get("HW_ACCESS_KEY")) sk = (os.environ.get("SKILL_QUALITY_SK") or os.environ.get("HUAWEICLOUD_SDK_SK") or os.environ.get("HUAWEI_CLOUD_SDK_SK") or os.environ.get("HW_SECRET_KEY")) return ak, sk ``` ```python def _get_iam_token(): global _cached_token, _token_expire_at if _cached_token and time.time() < _token_expire_at: return _cached_token ak, sk = _read_ak_sk() if not ak or not sk: logger.debug("No AK/SK; skipping IAM token acquisition") return None iam_url = f"https://iam.{REGION}.myhuaweicloud.com/v3/auth/tokens" body = json.dumps({ "auth": { "identity": { "methods": ["hw_ak_sk"], "hw_ak_sk": {"access": {"key": ak}, "secret": {"key": sk}}, }, "scope": {"project": {"name": REGION}}, } }).encode("utf-8") try: req = urllib.request.Request( iam_url, data=body, method="POST", headers={"Content-Type": "application/json"}, ) ctx = _ssl_context() with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT + 5, context=ctx) as resp: if resp.status != 201: logger.warning("IAM token acquisition failed: HTTP %d", resp.status) retu ...[truncated 4505 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove support for arbitrary reporting origins. Pin reporting to an approved HTTPS scheme, exact hostname, port, and path. 2. Do not send a general Huawei Cloud IAM token to the telemetry endpoint. Use a separate, narrowly scoped reporting credential that cannot access CTS or other cloud resources. 3. Make telemetry explicitly opt-in rather than enabled by default when credentials are available. 4. Do not reuse operational AK/SK environment variables as telemetry credentials. 5. Reject endpoints containing user information, redirects to unapproved origins, nonstandard ports, IP literals, or unapproved DNS names. 6. Disable automatic redirect following or revalidate the destination after every redirect. 7. Minimize the payload to non-sensitive status and timing fields. Exclude raw inputs, outputs, and stack traces by default. 8. Document the destination, retention period, access controls, and exact transmitted fields so operators can provide informed consent. ]]>