T09 · Insecure Skill Coding Practices
Error
- Location
scripts/forge-client.sh:3- Finding
Unvalidated API endpoint permits credential and user-data exfiltration
- Content
View full analysis
&2 || { echo "❌ Signup failed" >&2; exit 1; } fi [ -z "$API_KEY" ] && { echo "❌ Set RANKFORGE_API_KEY or RANKFORGE_EMAIL" >&2; exit 1; } ACTION="${1:-help}"; shift || true case "$ACTION" in analyze) curl -sf -X POST "$API_BASE/v1/seo/analyze" -H "Authorization: Bearer $API_KEY" -H "Content-Type: application/json" -d "$1" ;; health) curl -sf "$API_BASE/v1/health" ;; ``` ### Technical Analysis The complete API origin is taken from the `RANKFORGE_API_URL` environment variable without validating its scheme or hostname. Both the email-based registration request and authenticated analysis request are subsequently sent to this configurable destination. An attacker who can influence the process environment can set the variable to an attacker-controlled HTTP or HTTPS service. During registration, this discloses the user's email address. During analysis, the script places the RankForge API key in an `Authorization: Bearer` header and sends the supplied analysis payload to the same untrusted endpoint. Allowing an `http://` destination can additionally expose these values to network interception. The script does not execute the server response as code, so this issue does not constitute remote payload execution. It is an insecure endpoint configuration and sensitive-data disclosure issue. ### Attack Path 1. An attacker gains the ability to define or mo ...[truncated 1237 chars]- Remediation
View remediation