T09 · Insecure Skill Coding Practices
Error
- Location
src/client.ts:7- Finding
API key can be transmitted to an arbitrary configurable endpoint
- Content
View full analysis
( method: string, path: string, body?: any ): Promise> { const url = `${getBaseUrl()}/api/v1${path}`; const headers: Record = { 'x-api-key': getApiKey(), 'Content-Type': 'application/json', }; const res = await fetch(url, { method, headers, body: body ? JSON.stringify(body) : undefined, }); ``` ### Technical Analysis The HTTP client permits `AUCTION_HOUSE_URL` to replace the expected `https://www.houseproto.fun` origin without validating the URL scheme or hostname. The client then includes `AUCTION_HOUSE_API_KEY` in the `x-api-key` header on every request to that configured origin. An environment variable override may be useful for development, but sending an authorization credential to an unrestricted destination exceeds the minimum privilege required for the declared production functionality. The Skill only needs to authenticate to the legitimate House API. A compromised launcher, MCP configuration, inherited environment, or deployment manifest can redirect all requests and disclose the key. The same request mechanism handles public searches, account information, wallet information, auction creation, and bidding. Therefore, invoking any exported tool is sufficient to trigger credential transmission. ### Attack Path 1. An attacker modifies the MCP configuration, process environment, deployment manifest, or launch script. 2. The attacker sets `AUCTION_HOUSE_URL` to an HTTPS server under their control. 3. The user or agent invokes any Skill tool, such as `search_auctions` or `wallet_info`. 4. `getBaseUrl()` accepts the attacker-controlled origin without validation. 5. `r ...[truncated 969 chars]- Remediation
View remediation