T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/vision_rename.py:397
- Finding
- Local images and API credentials can be transmitted to an arbitrary endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/vision_rename.py:117-126`, `scripts/vision_rename.py:333-341`, and `scripts/vision_rename.py:397-421` **Vulnerability Type**: Unrestricted transmission of sensitive data and credentials **Risk Level**: High ### Evidence ```python def resolve_runtime_base_url(cli_value: str) -> str: skill_env = get_openclaw_skill_env("qwen-vision-rename") return first_non_empty( cli_value, os.getenv("DASHSCOPE_BASE_URL", ""), os.getenv("OPENAI_BASE_URL", ""), skill_env.get("DASHSCOPE_BASE_URL", ""), DEFAULT_BASE_URL, ) ``` ```python def local_image_to_data_url(path_str: str) -> str: path = Path(path_str).expanduser().resolve() if not path.is_file(): raise FileNotFoundError(f"Image file not found: {path}") mime, _ = mimetypes.guess_type(str(path)) if not mime: mime = "image/png" encoded = base64.b64encode(path.read_bytes()).decode("ascii") return f"data:{mime};base64,{encoded}" ``` ```python def call_vision_api( *, base_url: str, api_key: str, model: str, image: str, prompt: str, timeout: int, ) -> str: endpoint = base_url.rstrip("/") + "/chat/completions" payload = { "model": model, "messages": [ { "role": "user", "content": [ {"type": "text", "text": prompt}, {"type": "image_url", "image_url": {"url": image}}, ], } ], "temperature": 0, } resp = requests.post( endpoint, headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", }, json=payload, timeout=timeout, ) ``` ### Technical Analysis Cloud-based image recognition legitimately requires sending image data to a vision service. Base64 encoding is being used as a transport representation rath ...[truncated 2111 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Allowlist the documented DashScope HTTPS hosts by default. 2. Reject non-HTTPS endpoints and URLs containing embedded credentials. 3. Require an explicit, security-relevant confirmation before using any custom endpoint. 4. Do not automatically honor the generic `OPENAI_BASE_URL` variable for a Skill that uses a DashScope-specific credential. 5. Associate credentials with approved hosts and refuse to send a credential when the endpoint host does not match its provider. 6. Clearly disclose before execution that local image contents will be uploaded to an external vision service. 7. Consider adding a local-model mode for users who cannot transmit images externally. 8. Add automated tests verifying that HTTP endpoints, unexpected hosts, redirects to unapproved hosts, and host/credential mismatches are rejected. ]]>