T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:101
- Finding
- Bearer Token Exposure Through an Unvalidated Custom Base URL## Vulnerability Details **File Location**: `SKILL.md:101-109`, with related configuration in `setup.md:28` and `memory-template.md:18-20` **Vulnerability Type**: Unvalidated credential destination **Risk Level**: High ### Vulnerable Code Snippet From `SKILL.md`: ```markdown Self-hosted instances use custom base URL from memory.md. No other data is sent externally. ## Security & Privacy **Data that leaves your machine:** - Site ID (domain) and query parameters sent to Plausible API - API key sent as Bearer token ``` Related configuration from `setup.md`: ```markdown In `~/plausible/memory.md`: - Site IDs (domains) they track - Base URL (plausible.io or self-hosted) - Preferred default time period - Common query patterns - Goals/events they care about ``` Related template from `memory-template.md`: ```markdown ## Base URL <!-- plausible.io (default) or self-hosted URL --> <!-- Example: https://analytics.example.com --> ``` ### Technical Analysis The skill permits an arbitrary self-hosted base URL to be stored in persistent memory and directs authenticated requests to that destination. Those requests include `PLAUSIBLE_API_KEY` as a bearer token. The instructions do not require HTTPS, validate or allowlist the destination hostname, prohibit embedded credentials or redirects, block loopback and link-local addresses, or require user confirmation before sending the token to a newly configured host. As a result, an incorrect or attacker-influenced base URL can redirect the API credential to an unintended server. Although the skill correctly obtains the secret from an environment variable rather than storing it in plaintext, environmental secret storage does not prevent disclosure when the secret is transmitted to an untrusted destination. ### Attack Path 1. An attacker, misleading user input, or corrupted configuration causes a hostile URL to be written into the `Base URL` section of `~/plausible/memory.md`. 2. During a later analytics query, the agen ...[truncated 985 chars]
- Remediation
- ## Remediation Suggestions 1. Default exclusively to `https://plausible.io` unless the user explicitly enables a self-hosted endpoint. 2. Require custom base URLs to use HTTPS and reject HTTP, non-web schemes, embedded credentials, malformed hosts, and ambiguous URL forms. 3. Resolve and reject loopback, link-local, multicast, private-network, and cloud-metadata destinations unless a narrowly scoped local deployment has been explicitly approved. 4. Show the normalized destination hostname and request explicit confirmation before sending credentials to a custom host for the first time or after the host changes. 5. Bind each API credential to an approved hostname rather than automatically sending one global environment token to any configured base URL. 6. Revalidate the destination after redirects and never forward the authorization header across origins. 7. Protect `~/plausible/memory.md` with restrictive filesystem permissions and treat its endpoint configuration as security-sensitive. 8. Document credential rotation procedures and advise immediate rotation if an unauthorized endpoint may have received the token.